Vulnerability details

CVE-2026-90913

Joomla! Project Joomla! CMS

Joomla! Core - [20260903] - Core - Improper ACL checks for access level webservice endpoints in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3

CVSS 4.0

7.0High

Official description

Joomla! Core - [20260903] - Core - Improper ACL checks for access level webservice endpoints in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to perform mutation actions in access level endpoints.

CVSS scores

Score	Version	Source	Vector
7.0High	4.0	CVEProject cvelistV5 (CNA) (Joomla)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N`

Affected products

Vendor	Product	Versions	Source
Joomla! Project	Joomla! CMS	4.0.0-5.4.8	CVEProject cvelistV5 (CNA)
Joomla! Project	Joomla! CMS	6.0.0-6.1.3	CVEProject cvelistV5 (CNA)

References and advisories

https://www.joomla.org/ product
https://developer.joomla.org/security-centre/1083-20260903-core-improper-acl-checks-for-user-level-webservice-endpoints.html vendor-advisory

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-09-29
Last updated: 2026-09-30
State: Published
Assigner (CNA): Joomla

Exploit prediction (EPSS)

0.21%

Probability of exploitation in 30 days

11.7%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Partial

Weaknesses (CWE)

CWE-284
Improper Access Control