CVE-2026-92223
MediumCVSS 5.1Summary
Joomla! Core has improper ACL checks for workflow stage changes. Unauthorized users can update the workflow stage of inaccessible contents. Affects versions 5.0.0-5.4.8 and 6.0.0-6.1.3.
Risk Assessment
An unauthorized user may modify the workflow state of content they cannot access, potentially leading to unauthorized changes in editorial and publishing processes. This can compromise the integrity of data and business workflows.
Recommendation
Update Joomla! to a version containing the fix (outside 5.0.0-5.4.8 and 6.0.0-6.1.3). Verify whether any unauthorized workflow stage changes have occurred recently.
Other vulnerabilities in Joomla! Core
See all- CVE-2026-90918Medium
Joomla! Core's mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions. Affects versions 4.0.0-5.4.8 and 6.0.0-6.1.3.
- CVE-2026-90917Medium
Joomla! Core has improper ACL checks in outputs for tagged items. Unauthorized users can view content items from inaccessible categories. Affects versions 4.0.0-5.4.8 and 6.0.0-6.1.3.
- CVE-2026-90916Medium
Joomla! Core has improper ACL checks in the content history comparison view. Unauthorized users can view inaccessible contents. Affects versions 4.0.0-5.4.8 and 6.0.0-6.1.3.
- CVE-2026-90914Medium
Joomla! Core lacks escaping in the generic media output layouts, leading to an XSS vulnerability. Affects the generic audio and video output layouts. Affects versions 4.0.0-5.4.8 and 6.0.0-6.1.3.
- CVE-2026-90907Medium
Joomla! Core's profile.save controller did not check the login state of a user, allowing the creation of guest-level users on sites without active user registration. Affects versions 1.5.0-5.4.8 and 6.0.0-6.1.3.
- CVE-2026-90906Medium
Joomla! Core lacks escaping in the HTMLHelper::link method, leading to XSS vulnerabilities. Affects versions 1.5.0-5.4.8 and 6.0.0-6.1.3.
Original NVD description (English source)
Joomla! Core - [20260910] - Core - Improper ACL checks for workflow stage changes in Joomla 5.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to update the workflow stage of inaccessible contents.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS