CVE-2026-71574

CVE-2026-71574 is an improper access control flaw (CWE-284) in the Joomla! CMS core, affecting versions 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2, in which the webservice (REST API) endpoints enforce weaker ACL checks than the backend administration UI. An attacker holding credentials for an account with API access can send create, update, or delete requests to webservice endpoints and have them succeed even though the same mutations would be denied for that account in the backend; the CVSS 4.0 vector scores it as network-exploitable, low complexity, requiring high-privileged credentials and no user interaction. The impact is unauthorized modification of site data through the API without the required permissions, with the CVSS vector rating high impact to confidentiality and integrity and no availability impact. Any Joomla installation on the affected versions with the webservice plugins enabled and API users configured is exposed. No public proof-of-concept, no CISA KEV listing, and a low EPSS score of 0.2% indicate exploitation has not yet been observed.

What to do: Update Joomla installs in the 4.x/5.x line beyond 5.4.7 and in the 6.x line beyond 6.1.2 using the patched core releases published on 2026-08-03. Until patched, disable unneeded webservice plugins and restrict which API users/credentials can reach the /api endpoints, and review change logs for content mutations made by accounts lacking the corresponding backend permissions.