[20260906] - Core - Improper ACL checks in content history comparison view
Joomla patched low-severity CVE-2026-90916, an ACL flaw exposing restricted content history.
Joomla's Security Strike Team disclosed CVE-2026-90916, an incorrect access-control flaw in the CMS content history comparison view. An improper access check can let unauthorized users view inaccessible content. The issue affects Joomla CMS 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3, and is fixed in 5.4.9 and 6.1.4. Joomla rates impact, severity, and probability as low; exploitation is not reported.
- Improper ACL check in the content history comparison view.
- Unauthorized users can view contents they should not access.
- Affects Joomla CMS 4.0.0–5.4.8 and 6.0.0–6.1.3.
- Fixed in 5.4.9 and 6.1.4; vendor rates impact and probability low.
- CVEs
- CVE-2026-90916
- Vendors
- Joomla
- Products
- Joomla CMS
- Organizations
- Joomla Security Strike Team
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-90916 | Improper ACL check in Joomla content history view | 5.1 | — |
From the original article
Project: Joomla! SubProject: CMS Impact: Low Severity: Low Probability: Low Versions: 4. 0.
By Joomla! Security Strike Team · developer.joomla.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.