Alex Joseph
A new security vulnerability has been identified within the core of Joomla!, a popular content management system. This issue, tracked as CVE-2026-90913, involves improper access control checks that could allow unauthorized individuals to perform certain actions they shouldn’t be able to on your website. This is particularly concerning for websites using webservice endpoints, as it could lead to unexpected and unauthorized modifications.
CVE Details
This vulnerability affects Joomla! Core and was publicly disclosed on September 29, 2026. It is rated with a Medium severity level, carrying a CVSS score of 5.5. The status of this vulnerability is “Analyzed,” meaning its details have been thoroughly investigated and confirmed.
Affected Products
The improper access control vulnerability impacts the following versions of Joomla! CMS:
- Joomla! CMS versions 4.0.0 through 5.4.8
- Joomla! CMS versions 6.0.0 through 6.1.3
Current Status
The vulnerability has been thoroughly analyzed by the Joomla! Security Strike Team. This means the details, impact, and potential solutions have been confirmed and are publicly available to help administrators secure their installations.
Severity Level
Rated as Medium severity, this vulnerability presents a moderate risk. The core issue lies in “Improper ACL checks for access level webservice endpoints.” In simpler terms, the system fails to correctly verify user permissions when certain actions are attempted via webservice endpoints. This oversight could allow an attacker, even without proper authorization, to carry out “mutation actions”—which means they could make changes or manipulations through these endpoints. While not critical, it poses a risk to data integrity and unauthorized control.
Possible Solutions
Fortunately, a fix is available for this vulnerability. The Joomla! Security Strike Team released patches to address the improper access control checks. To protect your Joomla! installation, it is crucial to update your system to one of the following patched versions:
- Upgrade to Joomla! CMS version 5.4.9
- Upgrade to Joomla! CMS version 6.1.4
These updates were fixed by September 25, 2026. Promptly applying these updates will resolve the vulnerability and safeguard your website from potential unauthorized actions.
References
https://developer.joomla.org/security-centre/1083-20260903-core-improper-acl-checks-for-user-level-webservice-endpoints.html
https://www.joomla.org/
