CVE-2026-92226

Joomla core 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3 has improper access-control checks (CWE-284) on various webservice edit tasks. A remote attacker who already has high privileges can call those API edit actions without the intended ACL enforcement and change items that should not be editable, with high impact to integrity and limited impact to confidentiality and availability. CVSS 4.0 scores the issue 7.0 (High): network reachable, low complexity, no user interaction, and privileges required rated High. Every site running an affected Joomla 4.x, 5.x, or 6.x core release is in scope; Joomla 3.x is not listed. No public proof of concept is known and the CVE is not in the CISA KEV catalog.

What to do: Upgrade any Joomla site on 4.0.0–5.4.8 or 6.0.0–6.1.3 to a release outside those ranges using the official core security update tied to the 2026-09-13 advisory. Until then, limit webservice/API accounts to the least privilege needed and review recent API edit actions for changes to items that should have been uneditable. After updating, confirm the running version in the administrator and recheck privileged webservice edit endpoints.