[20260802] - Core - Improper CORS origin validation
Joomla patches CVE-2026-71573, improper CORS origin validation in CMS requests, in versions 5.4.8 and 6.1.3.
Joomla disclosed improper CORS origin validation (CVE-2026-71573), where configured CORS origins were not properly validated on CORS requests, rated moderate impact/severity and moderate probability. It affects Joomla CMS 4.0.0-5.4.7 and 6.0.0-6.1.2. Fixed in Joomla 5.4.8 and 6.1.3; reported on 2026-07-09 by Agamemnon Fakas and caveeroo.
- CVE-2026-71573 is improper CORS origin validation in Joomla CMS
- Affects Joomla CMS 4.0.0-5.4.7 and 6.0.0-6.1.2
- Fix available in Joomla 5.4.8 and 6.1.3
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-71573 | Unauthenticated CORS origin validation bypass in Joomla! Core 4.x–6.x | 6.9 | <1% |
From the original article
Project: Joomla! SubProject: CMS Impact: Moderate Severity: Moderate Probability: Moderate Versions: 4. 0.
By Joomla! Security Strike Team · developer.joomla.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.