Alex Joseph
Joomla!, a popular content management system, has addressed a security flaw that could allow unauthorized individuals to view private content. This vulnerability, identified as CVE-2026-90917, stems from improper checks in its Access Control List (ACL) system, specifically when handling tagged items. In simple terms, this means that some content items, even if they were assigned to categories that should have restricted access, could still be seen by users who shouldn’t have permission to view them. This unintentional exposure could potentially reveal sensitive information or content meant for a specific audience.
CVE Details
This particular security issue affects the core functionality of Joomla! CMS. It was officially published on September 29, 2026, and is rated with a Moderate severity level. The vulnerability was reported on July 28, 2026, and a fix was promptly released on September 25, 2026.
Affected Products
The improper ACL checks vulnerability impacts specific versions of Joomla! CMS. Users running the following versions are affected:
- Joomla! CMS versions 4.0.0 through 5.4.8
- Joomla! CMS versions 6.0.0 through 6.1.3
Current Status
The vulnerability has been thoroughly analyzed by the Joomla! Security Strike Team. Thankfully, a patch addressing this issue has been released, meaning a solution is available to secure your Joomla! installations.
Severity Level
Rated as “Moderate” severity, this vulnerability indicates a significant concern. While it doesn’t typically allow an attacker to take full control of a system or directly inject malicious code, it poses a risk to data confidentiality. The ability for unauthorized users to view restricted content can lead to information disclosure, which could have various implications depending on the nature of the exposed content.
Possible Solutions
The most crucial step to protect your Joomla! website from this vulnerability is to upgrade your installation immediately. The Joomla! project has provided specific updates to address the improper ACL checks. We strongly recommend that all administrators update their systems to the following patched versions:
- Upgrade to Joomla! CMS version 5.4.9
- Upgrade to Joomla! CMS version 6.1.4
Regularly applying updates and patches is a fundamental practice in maintaining a secure web environment. Always ensure your Joomla! instance and all its extensions are kept up-to-date.
References
https://developer.joomla.org/security-centre/1087-20260907-core-improper-acl-checks-in-outputs-for-tagged-items.html
https://www.joomla.org/
