CVE-2026-90917

Joomla core fails to enforce access-control checks when it renders outputs for tagged items. An unauthenticated remote attacker can request those tagged-item views and read content items that sit in categories they are not allowed to access. Impact is limited to low confidentiality: restricted content can be disclosed, with no indicated change to integrity or availability. Affected installations are Joomla 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3. No public proof-of-concept is known, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

What to do: Upgrade Joomla core to a vendor security release newer than 5.4.8 on the 5.x line and newer than 6.1.3 on the 6.x line. Sites still on 4.x are inside the affected range and should move to a fixed supported release. Until then, review tagged-item pages and modules and confirm that category-restricted articles are not visible to anonymous users.