Joomla patches two core auth flaws in 5.4.9 and 6.1.4
First coverage.
Joomla fixed an unauthenticated account-creation bug and an MFA bypass via remember-me cookies in CMS 5.4.9 and 6.1.4.
The Joomla Security Centre disclosed two core CMS flaws, CVE-2026-90907 and CVE-2026-92227, both fixed in 5.4.9 and 6.1.4. CVE-2026-90907 is an authorization bypass in the profile.save controller that lets unauthenticated visitors create guest accounts even when registration is disabled; it affects 1.5.0 through 5.4.8 and 6.0.0 through 6.1.3, and Joomla rates impact, severity, and probability as moderate. CVE-2026-92227 lets a remember-me cookie issued before MFA completes bypass multi-factor authentication on CMS 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3; the vendor rates impact high and severity and probability moderate, and credits Google, Ada Logics, and Mukul Goyal. Neither advisory reports in-the-wild exploitation. The two reports do not disagree on affected ranges or the recommended upgrades.
- CVE-2026-90907 is an authorization bypass in the core profile.save controller that skips a login check, so unauthenticated visitors can create guest accounts when registration is disabled.
- CVE-2026-90907 affects Joomla CMS 1.5.0 through 5.4.8 and 6.0.0 through 6.1.3; Joomla rates impact, severity, and probability moderate.
- CVE-2026-92227 is an MFA bypass in which a remember-me cookie is issued before MFA completes.
- CVE-2026-92227 affects Joomla CMS 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3; impact is rated high and severity and probability moderate.
- Both flaws are fixed in Joomla CMS 5.4.9 and 6.1.4.
- CVE-2026-92227 was reported by Google, Ada Logics, and Mukul Goyal.
- Neither advisory reports in-the-wild exploitation.
- Joomla Security Centre published both items on 2026-09-25; advisory titles are dated 20260902 and 20260914.
- Vendors
- Joomla
- Products
- Joomla CMS
- Organizations
- GoogleAda LogicsJoomla Security Strike Team
Coverage
oldest first · one row per article · UTC- · Sep 25, 2026
Joomla Security CentreFirst report
[20260902] - Core - Unauthorized user account creation via profile.save controller
Joomla CMS lets unauthenticated users create guest accounts via profile.save when registration is off, fixed in 5.4.9 and 6.1.4.
- · Sep 25, 2026
[20260914] - Core - MFA Authentication Bypass through rememberme cookies
Joomla remember-me cookies can bypass MFA on CMS 4.0.0–6.1.3; fixed in 5.4.9 and 6.1.4.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-92227+1 related CVE | MFA Bypass via Premature remember-me Cookie in Joomla Core 4.0.0–6.1.3 | 8.2 group max | — |