CVE-2026-92223

Joomla core 5.0.0 through 5.4.8 and 6.0.0 through 6.1.3 fails to enforce access checks when a workflow stage is changed (CWE-284). A user who already has high privileges can update the workflow stage of content they are otherwise not allowed to access, over the network, without user interaction. The result is unauthorized change of content workflow state, rated low for confidentiality and integrity and none for availability (CVSS 4.0 base 5.1); it is not described as code execution. Sites running those Joomla 5 and 6 core ranges are affected. No public proof-of-concept is known and the issue is not in CISA KEV, so exploitation is none known.

What to do: Upgrade Joomla core to a vendor-fixed release outside the affected ranges (later than 5.4.8 on the 5.x line, or later than 6.1.3 on the 6.x line). Until that update is applied, limit which highly privileged accounts can change workflow stages and review recent stage changes on content those accounts should not have been able to access.