CVE-2026-90907

Joomla’s profile.save controller did not check whether the requester was logged in, so an unauthenticated visitor can call it and create a guest-level account. The flaw is significant on sites that have user registration turned off, because those sites are not supposed to accept new users at all. The new account is only a guest, not an administrator: impact is limited confidentiality exposure of content meant for registered users (CVSS 4.0 6.9), not full site takeover. All Joomla releases from 1.5.0 through 5.4.8 and from 6.0.0 through 6.1.3 are affected. No public proof-of-concept is known and the issue is not in CISA’s KEV catalog.

What to do: Upgrade Joomla to a vendor-patched release newer than 5.4.8 on the 5.x line or newer than 6.1.3 on the 6.x line, per the [20260902] core advisory; 1.5 through 4.x are inside the affected range and should be moved to a supported fixed release. On sites where user registration is disabled, review the user list for unexpected guest accounts and remove any that an administrator did not create.