Alex Joseph
A significant security flaw has been identified in Joomla!, a widely used content management system. This vulnerability, tracked as CVE-2026-73371, relates to improper access control settings. It could allow individuals who are not authorized to perform certain actions to still copy “uneditable” items within the system. This means that if you use Joomla!, some of your content’s integrity might be at risk if not properly updated.
The issue stems from how Joomla! handles Access Control List (ACL) checks for batch copy operations. Essentially, the system fails to adequately verify user permissions, enabling unauthorized users to duplicate items they shouldn’t be able to touch. While this doesn’t directly allow modification or deletion of original content, the ability to copy uneditable items could lead to information leaks or system misuse, especially in environments where strict content management is crucial.
CVE Details
Product: Joomla! Core
CVE ID: CVE-2026-73371
Published Date: August 18, 2026
Severity: Medium
Status: Analyzed
Affected Products
The vulnerability affects specific versions of the Joomla! CMS. Users running the following versions are impacted:
- Joomla! 4.0.0 through 5.4.7
- Joomla! 6.0.0 through 6.1.2
It’s crucial for administrators to identify their current Joomla! version to determine if their installations are at risk.
Current Status
This vulnerability has been officially analyzed and confirmed by the Joomla! Security Strike Team. A fix was released on August 18, 2026, the same day the CVE was published. This means that patches are readily available, and administrators should prioritize applying them.
Severity Level
The vulnerability is rated as Medium severity. While it doesn’t permit direct modification or deletion of content by unauthorized users, the ability to copy uneditable items could still lead to issues. This could include unauthorized dissemination of sensitive information if the “uneditable” items contained such data, or it could be exploited as part of a larger attack chain to gain further access or disrupt operations indirectly. For any organization using Joomla!, even a medium severity vulnerability warrants prompt attention due to its potential impact on data integrity and security posture.
Possible Solutions
Joomla! has released updates that address this improper ACL check. To secure your Joomla! installation against CVE-2026-73371, you must upgrade your CMS to the patched versions:
- For Joomla! 5.x series, upgrade to version 5.4.8 or later.
- For Joomla! 6.x series, upgrade to version 6.1.3 or later.
Administrators should always back up their websites before performing any updates. Regular patching is a fundamental practice in maintaining a secure web environment.
References
https://developer.joomla.org/security-centre/1075-20260808-core-improper-acl-checks-for-batch-copy-actions.html
https://www.joomla.org/
