AI analysis
CVE-2026-72531 is an improper access control flaw (CWE-284) in the Joomla! CMS core, affecting the custom fields REST API (web service) endpoints. It is triggered when an authenticated, privileged user sends requests to these network-accessible API endpoints for a component they do not have permission to access, bypassing the ACL checks. The attacker can create custom fields on components that should be off-limits to them, a low-severity confidentiality and integrity issue scored 5.1 (medium) under CVSS 4.0. Any site running Joomla 4.0.0 through 5.4.7 or 6.0.0 through 6.1.2 is affected. There is no known public proof-of-concept, the issue is not in CISA's KEV catalog, and EPSS puts 30-day exploitation probability at just 0.2%, so no exploitation is currently known.
What to do: Upgrade Joomla! to a release beyond the affected ranges — at minimum 5.4.8 for the 5.x branch or 6.1.3 for the 6.x branch, or the latest available. As an interim mitigation, disable the Web Services – Custom Fields plugin or restrict API access until patched. After patching, review custom fields on restricted components to confirm no unauthorized fields were created.
Affected
| Joomla! CMS | 4.0.0 through 5.4.7 |
| Joomla! CMS | 6.0.0 through 6.1.2 |
Estimated exposure
mass≈1 million sites (Joomla powers roughly 1–2 million live websites, most now on the affected 4.x–6.x branches) — CMS market-share data puts Joomla on the order of 1–2 million live sites, and with 3.x end-of-life the majority of maintained installs run the affected 4.0+ branches, though only sites with authenticated users hitting the web services API…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Joomla! Core - [20260804] - Improper ACL checks for custom fields webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to create fields for inaccessible components.