Joomla fixes two ACL flaws in 5.4.9 and 6.1.4
First coverage.
Joomla fixed ACL flaws CVE-2026-92223 and CVE-2026-92226 in CMS 5.4.9 and 6.1.4; no exploitation is reported.
On 25 September 2026 the Joomla Security Centre reported two core improper ACL flaws, both fixed in Joomla CMS 5.4.9 and 6.1.4. CVE-2026-92223 lets unauthorized users change the workflow stage of content they cannot otherwise access; it affects 5.0.0–5.4.8 and 6.0.0–6.1.3, not the 4.x line, and the vendor rates impact low with moderate severity and probability. CVE-2026-92226 lets unauthorized users edit otherwise uneditable items through webservice edit tasks; the vendor rates impact high, also with moderate severity and probability, and lists affected releases as 4.0.0–5.4.8 and 6.0.0–6.1.3. The reports therefore differ on whether 4.x is in scope and on impact rating because those figures belong to different CVEs. Neither report says the issues have been exploited. CVE-2026-92223 was reported by Faceless; CVE-2026-92226 was reported by Google and Ada Logics.
- CVE-2026-92223 is an improper ACL check that lets unauthorized users change the workflow stage of content they cannot otherwise access; impact is rated low, with moderate severity and probability.
- CVE-2026-92223 affects Joomla CMS 5.0.0–5.4.8 and 6.0.0–6.1.3, not the 4.x line, and was reported by Faceless.
- CVE-2026-92226 is an improper ACL check on various webservice edit tasks that lets unauthorized users edit otherwise uneditable items; impact is rated high, with moderate severity and probability.
- CVE-2026-92226 affects Joomla CMS 4.0.0–5.4.8 and 6.0.0–6.1.3 and was reported by Google and Ada Logics.
- Both flaws are fixed in Joomla 5.4.9 and 6.1.4.
- Neither Joomla Security Centre report says either flaw has been exploited in the wild.
- The two advisories, titled [20260910] and [20260913], were carried in Joomla Security Centre reports timestamped 2026-09-25.
- Vendors
- Joomla
- Products
- Joomla CMS
- Organizations
- GoogleAda Logics
Coverage
oldest first · one row per article · UTC- · Sep 25, 2026
Joomla Security CentreFirst report
[20260910] - Core - Improper ACL checks for workflow stage changes
Joomla workflow stage changes lack ACL checks on inaccessible content; fixed in 5.4.9 and 6.1.4.
- · Sep 25, 2026
[20260913] - Core - Improper ACL checks for varous webservice edit tasks
Joomla webservice edit tasks skip ACL checks, allowing unauthorized edits; patched in 5.4.9 and 6.1.4.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-92226+1 related CVE | Improper ACL checks on Joomla webservice edit tasks | 7.0 group max | — |