AI analysis
CVE-2026-71574 is an improper access control flaw (CWE-284) in the Joomla! CMS core, affecting versions 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2, in which the webservice (REST API) endpoints enforce weaker ACL checks than the backend administration UI. An attacker holding credentials for an account with API access can send create, update, or delete requests to webservice endpoints and have them succeed even though the same mutations would be denied for that account in the backend; the CVSS 4.0 vector scores it as network-exploitable, low complexity, requiring high-privileged credentials and no user interaction. The impact is unauthorized modification of site data through the API without the required permissions, with the CVSS vector rating high impact to confidentiality and integrity and no availability impact. Any Joomla installation on the affected versions with the webservice plugins enabled and API users configured is exposed. No public proof-of-concept, no CISA KEV listing, and a low EPSS score of 0.2% indicate exploitation has not yet been observed.
What to do: Update Joomla installs in the 4.x/5.x line beyond 5.4.7 and in the 6.x line beyond 6.1.2 using the patched core releases published on 2026-08-03. Until patched, disable unneeded webservice plugins and restrict which API users/credentials can reach the /api endpoints, and review change logs for content mutations made by accounts lacking the corresponding backend permissions.
Affected
| Joomla! CMS (core) | 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2 |
Estimated exposure
mass≈1M+ sites (essentially the entire Joomla 4.x–6.x installed base; the web-services-enabled subset likely in the hundreds of thousands) — Public CMS market-share surveys place Joomla at roughly 1–2% of all websites, a multi-million-site installed base, and the affected ranges span every Joomla 4, 5, and 6 release, though only sites that enable the webservice plugins and…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform mutation actions in webservice endpoints, where the same mutation was restricted in the backend UI.