Alex Joseph
Unmasking Private Data: Joomla! Core Improper ACL Checks Vulnerability
Joomla! has identified a security concern where certain versions of its core content management system (CMS) were not properly checking user access permissions. This oversight could lead to sensitive contact information being exposed within a website’s underlying data structure, known as schema.org snippets, even if those contact details were meant to be private or restricted.
Essentially, access control lists (ACLs) are like digital gatekeepers, ensuring that only authorized users or processes can view specific information. In this case, the gatekeepers in Joomla! weren’t always doing their job correctly, allowing contact data for items that should have been inaccessible to slip into the schema.org output. Schema.org is a collaborative effort to create structured data markups that websites can use to provide search engines with rich, detailed information, like contact details for businesses or individuals.
CVE Details
Product Name: Joomla! Core
Published Date: August 18, 2026
Severity: Medium
Status: Analyzed
Affected Products
This vulnerability impacts specific versions of the Joomla! CMS. Users running the following versions should take immediate action:
- Joomla! CMS versions 5.1.0 through 5.4.7
- Joomla! CMS versions 6.0.0 through 6.1.2
Current Status
The vulnerability (CVE-2026-73372) has been fully analyzed by the Joomla! Security Strike Team. A fix has been released, and users are strongly encouraged to update their installations.
Severity Level
Rated as Medium severity, this vulnerability could potentially expose contact information that was intended to be private. While it doesn’t typically allow for full system takeover or remote code execution, the unauthorized disclosure of information is a significant concern for data privacy and compliance. Organizations handling sensitive contact details should prioritize addressing this issue promptly.
Possible Solutions
Fortunately, a solution is available. To remediate this improper ACL checks vulnerability, Joomla! users should upgrade their installations to the patched versions:
- For users of the 5.x series, upgrade to Joomla! CMS version 5.4.8.
- For users of the 6.x series, upgrade to Joomla! CMS version 6.1.3.
Always ensure you back up your website before performing any updates.
References
https://developer.joomla.org/security-centre/1076-20260809-core-improper-acl-checks-when-injection-schema-org-contact-data.html
https://www.joomla.org/
