[20260913] - Core - Improper ACL checks for varous webservice edit tasks
Joomla webservice edit tasks skip ACL checks, allowing unauthorized edits; patched in 5.4.9 and 6.1.4.
Joomla patched CVE-2026-92226, an improper ACL check on various webservice edit tasks that lets unauthorized users edit otherwise uneditable items. Affected releases are Joomla CMS 4.0.0–5.4.8 and 6.0.0–6.1.3. Impact is rated high, with moderate severity and probability. The fix is in 5.4.9 and 6.1.4. Exploitation in the wild is not reported.
- CVE-2026-92226 is an incorrect access-control flaw in webservice edit tasks.
- Unauthorized users can edit items that should be uneditable.
- Affects Joomla CMS 4.0.0–5.4.8 and 6.0.0–6.1.3.
- Upgrade to 5.4.9 or 6.1.4; reported by Google and Ada Logics.
- CVEs
- CVE-2026-92226
- Vendors
- Joomla
- Products
- Joomla CMS
- Organizations
- GoogleAda Logics
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-92226 | Improper ACL checks on Joomla webservice edit tasks | 7.0 | — |
From the original article
Project: Joomla! SubProject: CMS Impact: High Severity: Moderate Probability: Moderate Versions: 4. 0.
By Joomla! Security Strike Team · developer.joomla.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.