[20260903] - Core - Improper ACL checks for access level webservice endpoints
Joomla fixed CVE-2026-90913, an ACL flaw allowing unauthorized mutations on access-level APIs.
Joomla disclosed CVE-2026-90913, an incorrect access-control issue in CMS user-level webservice endpoints. An improper access check allows unauthorized users to perform mutation actions on access-level endpoints. Versions 4.0.0–5.4.8 and 6.0.0–6.1.3 are affected; 5.4.9 and 6.1.4 contain the fix. Joomla rates impact high and both severity and probability moderate, with no in-the-wild exploitation stated.
- Improper ACL checks on access-level webservice endpoints.
- Unauthorized users can perform mutation actions.
- Affects Joomla CMS 4.0.0–5.4.8 and 6.0.0–6.1.3.
- Impact rated high, severity and probability moderate; fixed in 5.4.9 and 6.1.4.
- CVEs
- CVE-2026-90913
- Vendors
- Joomla
- Products
- Joomla CMS
- Organizations
- Joomla Security Strike Team
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-90913 | Improper ACL checks in Joomla access-level web services | 7.0 | — |
From the original article
Project: Joomla! SubProject: CMS Impact: High Severity: Moderate Probability: Moderate Versions: 4. 0.
By Joomla! Security Strike Team · developer.joomla.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.