[20260803] - Core - Inconsistent ACL checks for mutating webservice endpoints
Joomla fixes CVE-2026-71574, inconsistent ACL checks letting unauthorized users mutate data via webservice APIs, in CMS 5.4.8/6.1.3.
Joomla disclosed an inconsistent access control flaw (CVE-2026-71574) in mutating webservice endpoints, where unauthorized users could perform mutations restricted in the backend UI; impact is rated high. It affects Joomla CMS 4.0.0-5.4.7 and 6.0.0-6.1.2, with moderate severity and low probability. The fix ships in Joomla 5.4.8 and 6.1.3 on 2026-08-18.
- CVE-2026-71574 lets unauthorized users perform mutations via webservice endpoints
- API mutations bypassed backend UI ACL restrictions; impact rated high
- Affects Joomla CMS 4.0.0-5.4.7 and 6.0.0-6.1.2
- Patched in Joomla 5.4.8 and 6.1.3
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-71574 | Inconsistent ACL checks in Joomla! webservice API allow unauthorized mutations | 8.5 | <1% |
From the original article
Project: Joomla! SubProject: CMS Impact: High Severity: Moderate Probability: Low Versions: 4. 0.
By Joomla! Security Strike Team · developer.joomla.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.