CVE-2026-76571
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
Joomla extension Fabrik before 4.7.2 has an unauthenticated SQL injection in the list filter condition parameter, as the condition parameter is concatenated verbatim into the WHERE clause built by getFilterQuery(), allowing full database read.
Risk Assessment
An unauthenticated attacker may read the entire database, leading to leakage of all data.
Recommendation
Update Fabrik to version 4.7.2 or later, which includes the fix.
Other vulnerabilities in Fabrik
See all- CVE-2026-77992Critical
The Joomla extension Fabrik before version 4.7.2 contains a heredoc terminator breakout vulnerability in the calc element. Additionally, the onUpdateComment endpoint did not perform any access checks.
- CVE-2026-76607Critical
Joomla extension Fabrik before 4.7.2 has a missing ACL check in the download element, potentially allowing unauthorized file access.
- CVE-2026-76606Critical
Joomla extension Fabrik before 4.7.2 is vulnerable to Path Traversal via the image element, potentially allowing access to files outside the application directory.
- CVE-2026-76605Critical
Joomla extension Fabrik before 4.7.2 allows remote code execution via the image element.
- CVE-2026-76604Critical
Joomla extension Fabrik before 4.7.2 has an unauthenticated remote code execution vulnerability via the PHP form element, which executes user-provided code.
- CVE-2026-76602Critical
Joomla extension Fabrik before 4.7.2 has an unauthenticated SQL injection in ORDER BY, as the order parameter in list models is used in queries without validation, allowing read SQLi vectors.
- CVE-2026-67282Critical
The Joomla extension Fabrik before version 4.6.8 has an unauthenticated remote code execution vulnerability. An attacker can execute arbitrary code by using the frontend listfilter model.
- CVE-2026-66915Critical
The Joomla extension Fabrik before version 4.7.2 contains a remote code execution vulnerability. An unauthenticated attacker can execute arbitrary code by using the ajax_calc feature of the calc plugin.
- CVE-2026-77027High
The Joomla extension Fabrik before version 4.7.2 contains an unauthenticated stored XSS vulnerability. The handling of user-supplied input in the jsactions feature leads to a stored XSS vector.
- CVE-2026-76609Medium
Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik < 4.7.2 - The onUpdateComment endpoint did not perform any access checks.
Original NVD description (English source)
Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2 - The condition parameter passed to a list filter is concatenated verbatim into the WHERE clause built by getFilterQuery(). An unauthenticated attacker can supply arbitrary SQL through the filter condition, giving full read of the database.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS