CVE-2026-71574

Analyzed Analyzed - Analysis Complete

Improper Access Control in Joomla Core Webservice Endpoints

Publication date: 2026-08-18

Last updated on: 2026-09-03

Assigner: Joomla! Project

Description

Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform mutation actions in webservice endpoints, where the same mutation was restricted in the backend UI.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-09-03

Generated

2026-09-08

AI Q&A

2026-08-18

EPSS Evaluated

2026-09-07

NVD

CVE-2026-71574

EUVD

EUVD-2026-61025

Affected Vendors & Products

Vendor	Product	Version / Range
joomla	joomla!	From 4.0.0 (inc) to 5.4.8 (exc)
joomla	joomla!	From 6.0.0 (inc) to 6.1.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

CVE-2026-71574 is a vulnerability in Joomla! CMS versions 4.0.0 to 5.4.7 and 6.0.0 to 6.1.2. It involves inconsistent Access Control List checks that allow unauthorized users to perform mutation actions through webservice endpoints. These actions should be restricted like in the backend UI, enabling potential unauthorized modifications.

Detection Guidance

To detect CVE-2026-71574, check Joomla versions against affected ranges (4.0.0-5.4.7, 6.0.0-6.1.2). Use commands like 'composer show joomla/joomla' or check 'administrator/components/com_admin/script.php' for version info. Monitor webservice endpoint logs for unauthorized mutation attempts.

Impact Analysis

This vulnerability allows unauthorized users to modify data or settings via webservice endpoints that should be protected. This could lead to data breaches, unauthorized changes to content, or system compromise. The impact is high but the likelihood of exploitation is low.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized modifications to data through webservice endpoints. Improper ACL checks may lead to unauthorized access or data breaches, which are key concerns under these regulations. Unauthorized mutations could violate data integrity and access control requirements.

Mitigation Strategies

Upgrade Joomla! to versions 5.4.8 or 6.1.3 or later to apply the official patches that fix the ACL checks for webservice endpoints.

Hi! I’m here to help you understand CVE-2026-71574. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70