CVE-2026-71573

Joomla! Core fails to properly validate the origins configured as allowed for cross-origin (CORS) requests, so CORS requests coming from origins that are not on the site's allow-list are accepted as valid. It is triggered whenever a browser sends a CORS request to an affected Joomla site that has CORS origins configured; because the origin check is broken, a page on an attacker-controlled origin can have a visitor's browser issue cross-origin requests to the Joomla site and have the responses treated as readable in the visitor's session context. What the attacker gains is limited but real cross-origin access — the ability to read or interact with responses from affected endpoints using the visitor's credentials — which the CVSS 4.0 score (6.9, Medium, low impact on the subsequent system) reflects. Anyone running Joomla 4.0.0 through 5.4.7 or 6.0.0 through 6.1.2 is within the affected ranges, although only sites where administrators have actually configured CORS origins are practically exposed. There is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS assigns a 0.2% probability of exploitation in the next 30 days, so no exploitation is currently known.

What to do: Upgrade to the latest patched release — at least Joomla 5.4.8 (for 4.x/5.x sites) or 6.1.3 (for 6.x sites), or later. In the meantime, review which origins your site's CORS configuration allows and, if you do not rely on cross-origin access to Joomla endpoints, restrict or temporarily disable it. After patching, confirm that any third-party origins that legitimately depend on CORS access to your site still work as expected.