Alex JosephUnderstanding the Joomla! Core Access Control Vulnerability
Joomla!, a popular content management system, has identified a security concern related to improper access control checks. This vulnerability, tracked as CVE-2026-90916, allows unauthorized users to view content that they normally shouldn’t have access to, specifically within the content history comparison view. While rated as a low-severity issue, it’s important for administrators and developers to understand and address it promptly to maintain the integrity and privacy of their website content.
CVE Details
This vulnerability affects the core functionality of Joomla!.
- Product: Joomla! Core
- Published Date: September 29, 2026
- Severity: Low
- Status: Analyzed
Affected Products
The improper access control vulnerability impacts specific versions of the Joomla! CMS. If your website runs on any of the following versions, it is considered vulnerable:
- Joomla! CMS versions 4.0.0 through 5.4.8
- Joomla! CMS versions 6.0.0 through 6.1.3
Current Status
The Joomla! Security Strike Team has thoroughly analyzed CVE-2026-90916. A fix for this vulnerability was released on September 25, 2026, meaning that patches are available for administrators to secure their installations.
Severity Level
This vulnerability is classified as Low Severity. A low-severity rating indicates that while the vulnerability could potentially lead to the exposure of sensitive information, the immediate threat to the overall system is not critical. However, any unauthorized access to content should be taken seriously, as it can undermine data privacy and user trust.
Possible Solutions
To protect your Joomla! website from CVE-2026-90916, it is crucial to upgrade your installation to the patched versions. The following updates resolve the improper ACL checks:
- Upgrade your Joomla! CMS to version 5.4.9
- Upgrade your Joomla! CMS to version 6.1.4
We recommend all users operating affected versions to implement these updates as soon as possible. Regular updates are a fundamental aspect of maintaining a secure web environment.
References
https://developer.joomla.org/security-centre/1086-20260906-core-improper-acl-checks-in-content-history-comparsion-view.html
https://www.joomla.org/
