[20260804] - Core - Improper ACL checks for custom fields webservice endpoints
Joomla patches CVE-2026-72531, an improper ACL check allowing unauthorized custom-field creation via webservice endpoints, in CMS 5.4.8/6.1.3.
22
Vulnerability2 · 1 read
CVE-2026-72531
Improper ACL checks in Joomla! core custom fields web service endpoints
- CVSS 4.0
- 5.1 medium
- EPSS
- <1%p9
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-72531 is an improper access control flaw (CWE-284) in the Joomla! CMS core, affecting the custom fields REST API (web service) endpoints. It is triggered when an authenticated, privileged user sends requests to these network-accessible API endpoints for a component they do not have permission to access, bypassing the ACL checks. The attacker can create custom fields on components that should be off-limits to them, a low-severity confidentiality and integrity issue scored 5.1 (medium) under CVSS 4.0. Any site running Joomla 4.0.0 through 5.4.7 or 6.0.0 through 6.1.2 is affected. There is no known public proof-of-concept, the issue is not in CISA's KEV catalog, and EPSS puts 30-day exploitation probability at just 0.2%, so no exploitation is currently known.
What to do: Upgrade Joomla! to a release beyond the affected ranges — at minimum 5.4.8 for the 5.x branch or 6.1.3 for the 6.x branch, or the latest available. As an interim mitigation, disable the Web Services – Custom Fields plugin or restrict API access until patched. After patching, review custom fields on restricted components to confirm no unauthorized fields were created.
| Product | Affected |
|---|---|
| Joomla! CMS | 4.0.0 through 5.4.7 |
| Joomla! CMS | 6.0.0 through 6.1.2 |
Estimated exposure
mass≈1 million sites (Joomla powers roughly 1–2 million live websites, most now on the affected 4.x–6.x branches) — CMS market-share data puts Joomla on the order of 1–2 million live sites, and with 3.x end-of-life the majority of maintained installs run the affected 4.0+ branches, though only sites with authenticated users hitting the web services API…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Joomla! Core - [20260804] - Improper ACL checks for custom fields webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to create fields for inaccessible components.
- Vendors
- joomla
- Products
- joomla\!
- Ecosystems
- Joomla
- Weakness
- CWE-284
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X