[20260902] - Core - Unauthorized user account creation via profile.save controller
Joomla CMS lets unauthenticated users create guest accounts via profile.save when registration is off, fixed in 5.4.9 and 6.1.4.
The Joomla Security Strike Team disclosed CVE-2026-90907, an authorization bypass in the core profile.save controller. The controller did not check whether a user was logged in, so guest-level accounts could be created on sites with user registration disabled. Affected releases are Joomla CMS 1.5.0 through 5.4.8 and 6.0.0 through 6.1.3. Joomla rates impact, severity, and probability as moderate and advises upgrading to 5.4.9 or 6.1.4.
- CVE-2026-90907 bypasses login checks in the profile.save controller.
- Unauthenticated visitors can create guest accounts when registration is disabled.
- Joomla CMS 1.5.0-5.4.8 and 6.0.0-6.1.3 are affected.
- Upgrade to 5.4.9 or 6.1.4; exploitation is not reported.
- CVEs
- CVE-2026-90907
- Vendors
- Joomla
- Products
- Joomla CMS
- Organizations
- Joomla Security Strike Team
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-90907 | Unauthorized guest account creation in Joomla core | 6.9 | <1% | PoC |
From the original article
Project: Joomla! SubProject: CMS Impact: Moderate Severity: Moderate Probability: Moderate Versions: 1. 5.
By Joomla! Security Strike Team · developer.joomla.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.