CVE-2026-90907
MediumCVSS 6.9Summary
Joomla! Core's profile.save controller did not check the login state of a user, allowing the creation of guest-level users on sites without active user registration. Affects versions 1.5.0-5.4.8 and 6.0.0-6.1.3.
Risk Assessment
An unauthorized user can create an account on the site even if registration is disabled, potentially leading to unauthorized access to resources. This can compromise the security and integrity of the system.
Recommendation
Update Joomla! to a version containing the fix (outside 1.5.0-5.4.8 and 6.0.0-6.1.3). Check for any unauthorized user accounts.
Other vulnerabilities in Joomla! Core
See all- CVE-2026-92223Medium
Joomla! Core has improper ACL checks for workflow stage changes. Unauthorized users can update the workflow stage of inaccessible contents. Affects versions 5.0.0-5.4.8 and 6.0.0-6.1.3.
- CVE-2026-90918Medium
Joomla! Core's mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions. Affects versions 4.0.0-5.4.8 and 6.0.0-6.1.3.
- CVE-2026-90917Medium
Joomla! Core has improper ACL checks in outputs for tagged items. Unauthorized users can view content items from inaccessible categories. Affects versions 4.0.0-5.4.8 and 6.0.0-6.1.3.
- CVE-2026-90916Medium
Joomla! Core has improper ACL checks in the content history comparison view. Unauthorized users can view inaccessible contents. Affects versions 4.0.0-5.4.8 and 6.0.0-6.1.3.
- CVE-2026-90914Medium
Joomla! Core lacks escaping in the generic media output layouts, leading to an XSS vulnerability. Affects the generic audio and video output layouts. Affects versions 4.0.0-5.4.8 and 6.0.0-6.1.3.
- CVE-2026-90906Medium
Joomla! Core lacks escaping in the HTMLHelper::link method, leading to XSS vulnerabilities. Affects versions 1.5.0-5.4.8 and 6.0.0-6.1.3.
Original NVD description (English source)
Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The profile.save controller did not check the login state of a user, allowing the creation of guest-level users on sites without active user registration.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS