CVE-2026-92227
HighCVSS 8.2Summary
Joomla! Core versions 4.0.0-5.4.8 and 6.0.0-6.1.3 have an MFA authentication bypass vulnerability due to premature issuance of a rememberme cookie. This allows bypassing the multi-factor authentication requirement.
Risk Assessment
An attacker who obtains the rememberme cookie can bypass MFA and gain unauthorized access to an account, potentially leading to account takeover and data breach.
Recommendation
Upgrade Joomla! to a patched version. Also consider invalidating all existing rememberme cookies and forcing re-authentication with MFA.
Other vulnerabilities in Joomla!
See all- CVE-2026-92232High
Joomla! Core versions 1.5.0-5.4.8 and 6.0.0-6.1.3 have an XSS filter bypass in InputFilter. The cleanAttribute method removes HTML data URIs, but injected whitespace characters can circumvent that cleanup, causing an XSS vector.
- CVE-2026-92231High
Joomla! Core versions 1.5.0-5.4.8 and 6.0.0-6.1.3 have an XSS filter bypass in InputFilter due to an HTML5 entity decode mismatch. The checkAttribute method normalizes an attribute value before testing it against the "javascript:" scheme regex, but without decoding HTML5 entities beforehand, causing an XSS vector.
- CVE-2026-92226High
Joomla! Core versions 4.0.0-5.4.8 and 6.0.0-6.1.3 have improper ACL checks for various webservice edit tasks. An improper access check allows unauthorized users to perform edit actions on otherwise uneditable items.
- CVE-2026-92225Medium
Joomla! Core - [20260912] - Core - XSS in module list in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The module list layout did not properly escape user supplied values, leading to an XSS vector.
- CVE-2026-92224Medium
Joomla! Core - [20260911] - Core - XSS in link toolbar layout in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The link toolbar layout did not properly escape inputs, leading to an XSS vector.
- CVE-2026-92222High
Joomla! Core versions 4.0.0-5.4.8 and 6.0.0-6.1.3 have SSRF vectors in various core extensions. URLs used for serverside requests were improperly validated, leading to SSRF vectors.
- CVE-2026-90915High
Joomla! Core versions 4.0.0-5.4.8 and 6.0.0-6.1.3 have an arbitrary directory deletion vulnerability via the cache purge action. An improper validation of the cache group name allowed path traversals in the file storage of the caching layer, resulting in arbitrary directory deletions.
- CVE-2026-90913High
Joomla! Core versions 4.0.0-5.4.8 and 6.0.0-6.1.3 have improper ACL checks for access level webservice endpoints. An improper access check allows unauthorized users to perform mutation actions in access level endpoints.
- CVE-2016-8870High
The register method in the UsersModelRegistration class in Joomla! before version 3.6.4, when registration has been disabled, allows remote attackers to create user accounts due to failure to check the 'Allow User Registration' configuration setting.
- CVE-2015-8769High
SQL injection vulnerability in Joomla! 3.x before 3.4.7 allows attackers to execute arbitrary SQL commands via unspecified vectors.
Original NVD description (English source)
Joomla! Core - [20260914] - Core - MFA Authentication Bypass through rememberme cookies in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The premature issuance of an rememberme cookie leads to a MFA bypass vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS