AI analysis
CVE-2026-72532 is an improper access control (ACL) check in Joomla! Core's webservice (API) endpoints for categories, affecting Joomla 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2. An authenticated API user whose account lacks permission to manage categories can send requests to the category webservice endpoints and create categories anyway; the CVSS vector indicates high required privileges and only low-severity confidentiality and integrity impact. An attacker gains the ability to insert unauthorized categories into the site's content structure, with no availability impact. Any Joomla 4.x, 5.x up to 5.4.7, or 6.x up to 6.1.2 installation is affected, though practical exploitation depends on the webservice API being enabled and reachable. No public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at about 0.2%, so no exploitation is currently known.
What to do: Update Joomla to a release later than 5.4.7 in the 5.4 series or later than 6.1.2 in the 6.1 series, per the 2026-08-06 core advisory; Joomla 4.x sites should upgrade to a supported 5.x release. As an interim mitigation, disable the category/content webservice plugins or restrict external access to the /api endpoints. After patching, review recently created categories for unauthorized changes.
Affected
| Joomla! Core | 4.0.0 through 5.4.7 |
| Joomla! Core | 6.0.0 through 6.1.2 |
Estimated exposure
mass≈1,000,000+ sites running Joomla 4.x–6.1.2 (only the subset with the webservice API plugins enabled is directly exploitable) — Joomla powers roughly 1–2% of CMS-based websites, on the order of a million or more live installations, and all 4.x through 6.1.2 builds carry the vulnerable code, although reachability via the /api category endpoints requires the…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Joomla! Core - [20260806] - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to create categories via webservices endpoints.