CVE-2026-71574
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
Joomla! Core versions 4.0.0-5.4.7 and 6.0.0-6.1.2 have a vulnerability related to inconsistent ACL checks for mutating webservice endpoints. An improper access check allows unauthorized users to perform mutation actions in webservice endpoints, where the same mutation was restricted in the backend UI.
Risk Assessment
Unauthorized users can modify data or perform operations that should be reserved for authorized administrators, potentially leading to data integrity compromise and system security issues.
Recommendation
Update Joomla! to a version that includes the fix (5.4.8 or later, 6.1.3 or later). Additionally, review ACL configuration and restrict access to webservice endpoints.
Original NVD description (English source)
Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform mutation actions in webservice endpoints, where the same mutation was restricted in the backend UI.