CVE-2026-90917
MediumCVSS 6.9Summary
Joomla! Core has improper ACL checks in outputs for tagged items. Unauthorized users can view content items from inaccessible categories. Affects versions 4.0.0-5.4.8 and 6.0.0-6.1.3.
Risk Assessment
An unauthorized user may access content that should be restricted, potentially leading to information disclosure. This can compromise the confidentiality of organizational data.
Recommendation
Update Joomla! to a version containing the fix (outside 4.0.0-5.4.8 and 6.0.0-6.1.3). Check for any unauthorized access to content.
Other vulnerabilities in Joomla! Core
See all- CVE-2026-92223Medium
Joomla! Core has improper ACL checks for workflow stage changes. Unauthorized users can update the workflow stage of inaccessible contents. Affects versions 5.0.0-5.4.8 and 6.0.0-6.1.3.
- CVE-2026-90918Medium
Joomla! Core's mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions. Affects versions 4.0.0-5.4.8 and 6.0.0-6.1.3.
- CVE-2026-90916Medium
Joomla! Core has improper ACL checks in the content history comparison view. Unauthorized users can view inaccessible contents. Affects versions 4.0.0-5.4.8 and 6.0.0-6.1.3.
- CVE-2026-90914Medium
Joomla! Core lacks escaping in the generic media output layouts, leading to an XSS vulnerability. Affects the generic audio and video output layouts. Affects versions 4.0.0-5.4.8 and 6.0.0-6.1.3.
- CVE-2026-90907Medium
Joomla! Core's profile.save controller did not check the login state of a user, allowing the creation of guest-level users on sites without active user registration. Affects versions 1.5.0-5.4.8 and 6.0.0-6.1.3.
- CVE-2026-90906Medium
Joomla! Core lacks escaping in the HTMLHelper::link method, leading to XSS vulnerabilities. Affects versions 1.5.0-5.4.8 and 6.0.0-6.1.3.
Original NVD description (English source)
Joomla! Core - [20260907] - Core - Improper ACL checks in outputs for tagged items in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to view content items from inaccessible categories.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS