CVE-2026-90916
MediumCVSS 5.1Summary
Joomla! Core has improper ACL checks in the content history comparison view. Unauthorized users can view inaccessible contents. Affects versions 4.0.0-5.4.8 and 6.0.0-6.1.3.
Risk Assessment
An unauthorized user may access the change history of content that should be restricted, potentially leading to information disclosure. This can compromise the confidentiality of organizational data.
Recommendation
Update Joomla! to a version containing the fix (outside 4.0.0-5.4.8 and 6.0.0-6.1.3). Check for any unauthorized access to content history.
Other vulnerabilities in Joomla! Core
See all- CVE-2026-92223Medium
Joomla! Core has improper ACL checks for workflow stage changes. Unauthorized users can update the workflow stage of inaccessible contents. Affects versions 5.0.0-5.4.8 and 6.0.0-6.1.3.
- CVE-2026-90918Medium
Joomla! Core's mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions. Affects versions 4.0.0-5.4.8 and 6.0.0-6.1.3.
- CVE-2026-90917Medium
Joomla! Core has improper ACL checks in outputs for tagged items. Unauthorized users can view content items from inaccessible categories. Affects versions 4.0.0-5.4.8 and 6.0.0-6.1.3.
- CVE-2026-90914Medium
Joomla! Core lacks escaping in the generic media output layouts, leading to an XSS vulnerability. Affects the generic audio and video output layouts. Affects versions 4.0.0-5.4.8 and 6.0.0-6.1.3.
- CVE-2026-90907Medium
Joomla! Core's profile.save controller did not check the login state of a user, allowing the creation of guest-level users on sites without active user registration. Affects versions 1.5.0-5.4.8 and 6.0.0-6.1.3.
- CVE-2026-90906Medium
Joomla! Core lacks escaping in the HTMLHelper::link method, leading to XSS vulnerabilities. Affects versions 1.5.0-5.4.8 and 6.0.0-6.1.3.
Original NVD description (English source)
Joomla! Core - [20260906] - Core - Improper ACL checks in content history comparison view in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to view inaccessible contents.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS