CVE-2026-90916

Joomla! Core has an improper access-control check (CWE-284) in the content history comparison view. A user who can reach that view can bypass ACL restrictions and read content they are not allowed to see; the vendor describes this as unauthorized viewing of inaccessible content, while CVSS 4.0 rates it as network-reachable, low complexity, high privileges required, no user interaction, and low confidentiality impact only (no integrity or availability impact). Affected releases are Joomla 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3, with a CVSS 4.0 base score of 5.1 (medium). It is not in CISA KEV and no public proof-of-concept is known.

What to do: Upgrade Joomla! to a vendor-patched release outside the affected ranges 4.0.0–5.4.8 and 6.0.0–6.1.3, confirming the exact fixed version in the official Joomla security advisory before deploying. Until then, limit who can open the content history comparison view and review whether access-restricted or unpublished content may have been viewed. No public exploit is known, but the issue is network-reachable with low attack complexity.