[20260903] - Core - Improper ACL checks for access level webservice endpoints
Joomla fixed CVE-2026-90913, an ACL flaw allowing unauthorized mutations on access-level APIs.
48
Vulnerability1 · 1 read
CVE-2026-90913
Improper ACL checks in Joomla access-level web services
- CVSS 4.0
- 7.0 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Joomla core fails to enforce access-control checks on webservice endpoints that manage access levels. An attacker who already holds high privileges can call those endpoints and perform mutation actions the ACL should have blocked. Successful abuse can alter access-level configuration, with high confidentiality impact and low integrity impact on the site and no direct availability impact. The issue affects Joomla 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3. It is not in the CISA KEV catalog, and no public proof-of-concept is known.
What to do: Upgrade Joomla to a release outside the vulnerable ranges (newer than 5.4.8 on the 4.x/5.x line and newer than 6.1.3 on the 6.x line) as soon as the vendor update is installed. Until then, restrict which high-privilege accounts can reach the webservice API and review recent access-level changes for unexpected mutations.
| Product | Affected |
|---|---|
| Joomla! Core | 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3 |
Estimated exposure
largeon the order of 100,000–1,000,000 Joomla sites — Joomla is a widely deployed CMS; public market-share surveys have long placed active installations in the hundreds of thousands to around one million sites, and these ranges cover supported 4.x/5.x and early 6.x cores, though the…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Joomla! Core - [20260903] - Core - Improper ACL checks for access level webservice endpoints in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to perform mutation actions in access level endpoints.
- Vendors
- joomla
- Products
- joomla\!
- Ecosystems
- Joomla
- Weakness
- CWE-284
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X