[20260907] - Core - Improper ACL checks in outputs for tagged items
Joomla patched ACL flaw CVE-2026-90917 that lets users view tagged items in inaccessible categories.
Joomla patched CVE-2026-90917, an incorrect access-control flaw in outputs for tagged items. An improper access check lets unauthorized users view content items from categories they should not access. The vendor rates impact low, severity moderate, and probability moderate. Affected releases are Joomla CMS 4.0.0–5.4.8 and 6.0.0–6.1.3, fixed in 5.4.9 and 6.1.4. Sabuhi Mammadov reported it on 2026-07-28; it was fixed on 2026-09-25.
- CVE-2026-90917 is an improper ACL check on tagged-item output.
- Unauthorized users can view content from inaccessible categories.
- Vendor rates impact low, severity moderate, probability moderate.
- Fixed in Joomla CMS 5.4.9 and 6.1.4.
- CVEs
- CVE-2026-90917
- Vendors
- Joomla
- Products
- Joomla CMS
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-90917 | Improper ACL checks in Joomla tagged-item output | 6.9 | — |
From the original article
Project: Joomla! SubProject: CMS Impact: Low Severity: Moderate Probability: Moderate Versions: 4. 0.
By Joomla! Security Strike Team · developer.joomla.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.