[20260804] - Core - Improper ACL checks for custom fields webservice endpoints
Joomla patches CVE-2026-72531, an improper ACL check allowing unauthorized custom-field creation via webservice endpoints, in CMS 5.4.8/6.1.3.
Joomla disclosed an incorrect access control issue (CVE-2026-72531) letting unauthorized users create custom fields for inaccessible components through webservice endpoints. It affects Joomla CMS 4.0.0-5.4.7 and 6.0.0-6.1.2, rated moderate impact and severity with low probability. Fixed in Joomla 5.4.8 and 6.1.3; reported by ebadfd on 2026-07-06.
22