CVE Catalog
CVE-2026-77992
CriticalCVSS 9.5Summary
The Joomla extension Fabrik before version 4.7.2 contains a heredoc terminator breakout vulnerability in the calc element. Additionally, the onUpdateComment endpoint did not perform any access checks.
Risk Assessment
Lack of access control may allow unauthorized users to modify comments or exploit the heredoc issue to perform unintended actions.
Recommendation
Update Fabrik to version 4.7.2 or later to fix the vulnerability and add proper access controls.
Original NVD description (English source)
Joomla Extension - fabrikar.com - heredoc terminator breakout in the calc element in Fabrik < 4.7.2 - The onUpdateComment endpoint did not perform any access checks.