[20260805] - Core - Improper ACL checks for category webservice endpoints

CVE-2026-72532 is an improper access control (ACL) check in Joomla! Core's webservice (API) endpoints for categories, affecting Joomla 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2. An authenticated API user whose account lacks permission to manage categories can send requests to the category webservice endpoints and create categories anyway; the CVSS vector indicates high required privileges and only low-severity confidentiality and integrity impact. An attacker gains the ability to insert unauthorized categories into the site's content structure, with no availability impact. Any Joomla 4.x, 5.x up to 5.4.7, or 6.x up to 6.1.2 installation is affected, though practical exploitation depends on the webservice API being enabled and reachable. No public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at about 0.2%, so no exploitation is currently known.

Do: Update Joomla to a release later than 5.4.7 in the 5.4 series or later than 6.1.2 in the 6.1 series, per the 2026-08-06 core advisory; Joomla 4.x sites should upgrade to a supported 5.x release. As an interim mitigation, disable the category/content webservice plugins or restrict external access to the /api endpoints. After patching, review recently created categories for unauthorized changes.