Alex Joseph
Understanding the Risk: Unauthorized Account Creation
A significant security flaw has been identified in Joomla!, a popular content management system. This vulnerability could allow unauthorized individuals to create user accounts on websites, even if user registration is turned off. This means that a site administrator might find new, unexpected user accounts popping up, which could lead to further security issues if exploited by malicious actors.
CVE Details
This particular issue is officially tracked as CVE-2026-90907. It affects the core of the Joomla! CMS. The vulnerability was publicly disclosed on September 29, 2026, and is rated with a Medium severity level. The status of this vulnerability is “Analyzed”, indicating that it has been thoroughly investigated and understood by the security community.
- Product: Joomla! Core
- Published Date: September 29, 2026
- Severity: Medium
- Status: Analyzed
Affected Products
The vulnerability impacts several versions of the Joomla! Content Management System. Specifically, if you are running any of the following versions, your site is at risk:
- Joomla! 1.5.0 through 5.4.8
- Joomla! 6.0.0 through 6.1.3
It’s crucial for administrators to verify their current Joomla! installation version to determine if they are affected.
Current Status
The vulnerability has been thoroughly analyzed, and the Joomla! security team has provided specific solutions. The issue stems from the profile.save controller, which failed to adequately check a user’s login status. This oversight allowed the creation of new user accounts even when the website’s user registration feature was explicitly disabled, a critical setting for many sites aiming to restrict new account sign-ups.
Severity Level
With a CVSS score of 5.3, this vulnerability is classified as Medium severity. While it doesn’t immediately grant full control over your website, the ability for unauthorized users to create accounts poses a significant risk. These newly created accounts, even if initially at a “guest-level,” could potentially be exploited further or used to bypass other security measures, making your site more susceptible to other attacks.
Possible Solutions
The good news is that Joomla! has released patches to address this vulnerability. To protect your website, the most important step is to update your Joomla! installation immediately to a secure version. The recommended updates are:
- Upgrade to Joomla! version 5.4.9
- Upgrade to Joomla! version 6.1.4
Upgrading ensures that the faulty profile.save controller is replaced with a secured version that correctly enforces login state checks, preventing unauthorized account creation. Regularly updating your CMS is a fundamental cybersecurity best practice to safeguard against known vulnerabilities like this one.
References
https://developer.joomla.org/security-centre/1082-20260902-core-unauthorized-user-account-creation-via-profile-save-controller.html
https://www.joomla.org/
