[20260910] - Core - Improper ACL checks for workflow stage changes
Joomla workflow stage changes lack ACL checks on inaccessible content; fixed in 5.4.9 and 6.1.4.
Joomla disclosed CVE-2026-92223, an improper ACL check that lets unauthorized users change the workflow stage of content they cannot otherwise access. Affected versions are Joomla CMS 5.0.0–5.4.8 and 6.0.0–6.1.3. Impact is rated low, with moderate severity and probability. The issue is fixed in 5.4.9 and 6.1.4. No exploitation is reported.
- CVE-2026-92223 allows unauthorized workflow stage changes on inaccessible content.
- Affects Joomla CMS 5.0.0–5.4.8 and 6.0.0–6.1.3, not the 4.x line.
- Vendor rates impact low and severity and probability moderate.
- Upgrade to 5.4.9 or 6.1.4; reported by researcher Faceless.
- CVEs
- CVE-2026-92223
- Vendors
- Joomla
- Products
- Joomla CMS
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-92223 | Improper workflow-stage ACL checks in Joomla core | 5.1 | — |
From the original article
Project: Joomla! SubProject: CMS Impact: Low Severity: Moderate Probability: Moderate Versions: 5. 0.
By Joomla! Security Strike Team · developer.joomla.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.