[20260805] - Core - Improper ACL checks for category webservice endpoints
Joomla fixes CVE-2026-72532, an improper ACL check letting unauthorized users create categories via webservice endpoints, in CMS 5.4.8/6.1.3.
Joomla disclosed an incorrect access control flaw (CVE-2026-72532) in category webservice endpoints, allowing unauthorized users to create categories for inaccessible components. It affects Joomla CMS 4.0.0-5.4.7 and 6.0.0-6.1.2 and is rated moderate impact and severity with low probability. The fix ships in Joomla 5.4.8 and 6.1.3 on 2026-08-18; it was reported by Amin Isayev and Geo.
- CVE-2026-72532 is an incorrect access control flaw in category webservice endpoints
- Affects Joomla CMS 4.0.0-5.4.7 and 6.0.0-6.1.2
- Rated moderate severity/impact with low probability of exploitation
- Patched in Joomla 5.4.8 and 6.1.3 released August 18, 2026
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-72532 | Improper ACL checks in Joomla! category webservice endpoints | 5.1 | <1% |
From the original article
Project: Joomla! SubProject: CMS Impact: Moderate Severity: Moderate Probability: Low Versions: 4. 0.
By Joomla! Security Strike Team · developer.joomla.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.