[20260804] - Core - Improper ACL checks for custom fields webservice endpoints
Joomla patches CVE-2026-72531, an improper ACL check allowing unauthorized custom-field creation via webservice endpoints, in CMS 5.4.8/6.1.3.
Joomla disclosed an incorrect access control issue (CVE-2026-72531) letting unauthorized users create custom fields for inaccessible components through webservice endpoints. It affects Joomla CMS 4.0.0-5.4.7 and 6.0.0-6.1.2, rated moderate impact and severity with low probability. Fixed in Joomla 5.4.8 and 6.1.3; reported by ebadfd on 2026-07-06.
- CVE-2026-72531 allows unauthorized custom-field creation via webservice endpoints
- Affects Joomla CMS 4.0.0-5.4.7 and 6.0.0-6.1.2
- Fix shipped in Joomla 5.4.8 and 6.1.3
- CVEs
- CVE-2026-72531
- Vendors
- Joomla
- Products
- Joomla CMS
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-72531 | Improper ACL checks in Joomla! core custom fields web service endpoints | 5.1 | <1% |
From the original article
Project: Joomla! SubProject: CMS Impact: Moderate Severity: Moderate Probability: Low Versions: 4. 0.
By Joomla! Security Strike Team · developer.joomla.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.