[20260809] - Core - Improper ACL checks when injection schema.org contact data
Joomla fixed CVE-2026-73372, an improper ACL check that leaks inaccessible contact items' data into schema.org snippets, affecting CMS 5.1.0-5.4.7 and 6.0.0-6.1.2.
Joomla security advisory 20260809 describes CVE-2026-73372, an incorrect access control issue when injecting schema.org contact data. Improper access checks inject contact information for inaccessible contact items into schema.org snippets, exposing restricted data. Affected versions are 5.1.0-5.4.7 and 6.0.0-6.1.2; fixes ship in 5.4.8 and 6.1.3. The issue was reported by Stefan Wendhausen on 2026-07-31.
- Improper ACL check leaks inaccessible contact data in schema.org snippets
- Affects Joomla CMS 5.1.0-5.4.7 and 6.0.0-6.1.2
- Fixed in Joomla 5.4.8 and 6.1.3
- CVEs
- CVE-2026-73372
- Vendors
- Joomla
- Products
- Joomla CMS
- Organizations
- Joomla
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-73372 | Improper ACL check leaks restricted contact data via schema.org in Joomla! Core | 5.1 | <1% |
From the original article
Project: Joomla! SubProject: CMS Impact: Low Severity: Low Probability: Low Versions: 5. 1.
By Joomla! Security Strike Team · developer.joomla.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.