CVE-2026-90913
Received Received - Intake

Improper ACL Checks in Joomla Core

Publication date: 2026-09-29

Last updated on: 2026-09-29

Assigner: Joomla! Project

Description
Joomla! Core - [20260903] - Core - Improper ACL checks for access level webservice endpoints in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to perform mutation actions in access level endpoints.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-29
Last Modified
2026-09-29
Generated
2026-09-29
AI Q&A
2026-09-29
EPSS Evaluated
N/A
NVD
CVE-2026-90913
EUVD
EUVD-2026-89115

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
joomla joomla From 4.0.0 (inc) to 6.1.4 (exc)
joomla joomla From 6.0.0 (inc) to 6.1.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-90913 is an improper access control vulnerability in Joomla! CMS versions 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3. It allows unauthorized users to perform mutation actions in access level web service endpoints due to flawed ACL checks.

Detection Guidance

To detect this vulnerability, check your Joomla version against affected ranges (4.0.0-5.4.8, 6.0.0-6.1.3). Use commands like 'composer show joomla/joomla' or check the Joomla admin panel under System > System Information. Review web service endpoint logs for unauthorized mutation actions.

Impact Analysis

This vulnerability could allow attackers to modify data or perform unauthorized actions on a Joomla! site without proper permissions. It may lead to data breaches, unauthorized content changes, or system compromise depending on the site's configuration.

Compliance Impact

This vulnerability could lead to unauthorized data access or modifications, potentially violating GDPR (data protection) or HIPAA (health data privacy) requirements. Organizations may face compliance penalties if exploited.

Mitigation Strategies

Immediately upgrade Joomla to versions 5.4.9 or 6.1.4. If upgrading is not possible, apply the patch from the Joomla Security Centre. Disable web service endpoints if not required and monitor for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90913. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart