CVE-2026-73371

Analyzed Analyzed - Analysis Complete

Improper ACL Checks in Joomla Core Batch Copy

Publication date: 2026-08-18

Last updated on: 2026-09-03

Assigner: Joomla! Project

Description

Joomla! Core - [20260808] - Improper ACL checks for batch copy actions in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform copy batch operations on uneditable items.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-09-03

Generated

2026-09-07

AI Q&A

2026-08-18

EPSS Evaluated

2026-09-06

NVD

CVE-2026-73371

EUVD

EUVD-2026-61028

Affected Vendors & Products

Vendor	Product	Version / Range
joomla	joomla!	From 6.0.0 (inc) to 6.1.3 (inc)
joomla	joomla!	From 4.0.0 (inc) to 5.4.8 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

CVE-2026-73371 is an improper access control vulnerability in Joomla! CMS versions 4.0.0-5.4.7 and 6.0.0-6.1.2. It allows unauthorized users to perform batch copy operations on items they lack permission to edit due to flawed ACL checks.

Detection Guidance

Check Joomla version using command: grep -r 'JVERSION=' /path/to/joomla/libraries/src/Version.php. If version is between 4.0.0-5.4.7 or 6.0.0-6.1.2, the system is vulnerable.

Impact Analysis

Unauthorized users could copy sensitive or restricted content without permission, potentially leading to data leaks or integrity issues. The impact is considered low but could affect content management workflows.

Compliance Impact

This vulnerability allows unauthorized users to perform batch copy actions on uneditable items, which could lead to unauthorized data access or exfiltration. Such unauthorized access may violate data protection principles under GDPR (e.g., integrity and confidentiality) and HIPAA (e.g., unauthorized access to protected health information).

Mitigation Strategies

Upgrade Joomla to version 5.4.8 or 6.1.3 immediately. If upgrading is not possible, apply the patch from the Joomla Security Centre or disable batch copy operations until patched.

Hi! I’m here to help you understand CVE-2026-73371. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70