[20260906] - Core - Improper ACL checks in content history comparison view
Joomla patched low-severity CVE-2026-90916, an ACL flaw exposing restricted content history.
28
Organization
Joomla Security Strike Team
- Mentions · 7d0
- Mentions · 30d0
- All mentions6
- First seenSep 25, 2026
- Last mentionedSep 25, 2026
Timeline
6 articles · newest first[20260905] - Core - Arbitrary directory deletion via cache purge action
Joomla fixed high-severity CVE-2026-90915, a cache-purge path traversal that can delete directories.
58
[20260904] - Core - XSS in the generic media output layouts
Joomla patched moderate XSS CVE-2026-90914 in generic audio and video media layouts.
40
[20260903] - Core - Improper ACL checks for access level webservice endpoints
Joomla fixed CVE-2026-90913, an ACL flaw allowing unauthorized mutations on access-level APIs.
48
[20260902] - Core - Unauthorized user account creation via profile.save controller
Joomla CMS lets unauthenticated users create guest accounts via profile.save when registration is off, fixed in 5.4.9 and 6.1.4.
44
[20260901] - Core - XSS in HTMLHelper::link method
Joomla HTMLHelper::link lacks output escaping, enabling XSS in CMS 1.5.0-6.1.3; patches are 5.4.9 and 6.1.4.
34
Related CVEs
by mentions- Path traversal directory deletion in Joomla core
- Improper ACL checks in Joomla access-level web services
- CVE-2026-90907<1%6.9Unauthorized guest account creation in Joomla core
- XSS in Joomla core audio and video media layouts
- XSS in Joomla core HTMLHelper::link method
- Improper ACL check in Joomla content history view
Appears with
- Joomlavendor · 6
- Joomla CMSproduct · 6
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.