CVE-2026-73327
Elevated risk· EPSS 55%Exploitation Probability (EPSS)
Elevated risk55th percentile - higher than 55% of all known CVEs
Summary
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as the reported behavior is intentional. The update process is designed to write files to disk and is restricted to the highest-privilege users working with cryptographically verified Joomla archives.
Risk Assessment
There is no active risk as the vulnerability has been rejected as intentional behavior. Organizations do not need to take remediation actions.
Recommendation
No action is required as the CVE has been rejected. However, monitor CNA communications to confirm the status.
Other vulnerabilities in Joomla
See all- CVE-2016-8870High
The register method in the UsersModelRegistration class in Joomla! before version 3.6.4, when registration has been disabled, allows remote attackers to create user accounts due to failure to check the 'Allow User Registration' configuration setting.
- CVE-2015-8769High
SQL injection vulnerability in Joomla! 3.x before 3.4.7 allows attackers to execute arbitrary SQL commands via unspecified vectors.
- CVE-2015-8565High
A directory traversal vulnerability in Joomla! versions 3.2.0 through 3.4.x before 3.4.6 allows remote attackers to have unspecified impact via unknown vectors.
- CVE-2015-8564High
Directory traversal vulnerability in Joomla! 3.4.x before 3.4.6 allows remote attackers to have unspecified impact via directory traversal sequences in the XML install file in an extension package archive.
- CVE-2015-8562High
Joomla! versions 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header.
- CVE-2015-7297High
Joomla! versions 3.2 before 3.4.4 have an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- CVE-2014-6632High
Joomla! versions 2.5.x before 2.5.25, 3.x before 3.2.4, and 3.3.x before 3.3.4 allow remote attackers to authenticate and bypass intended access restrictions via vectors involving LDAP authentication.
- CVE-2026-65760Critical
Improper access checks in the Easy Store extension (versions 1.0.0-2.0.1) for Joomla allow logged-in users to retrieve order and customer information of any order in the system.
- CVE-2026-48904Critical
Vulnerability in Joomla! due to improper access control in the com_users group editing webservice endpoint. Allows privilege escalation.
- CVE-2026-48899Critical
An improper access check allows privilege escalation through the com_users batch task.
Original NVD description (English source)
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as the reported behavior is intentional. The update process is designed to write files to disk and is restricted to the highest-privilege users working with cryptographically verified Joomla archives.