A significant security flaw has been identified in Joomla!, a popular content management system. This vulnerability could allow unauthorized individuals to create user accounts on websites, even if user registration is turned off. This means that a site administrator might find new, unexpected user accounts popping up, which could lead to further security issues if exploited by malicious actors.<\/p>\n
This particular issue is officially tracked as CVE-2026-90907<\/strong>. It affects the core of the Joomla! CMS. The vulnerability was publicly disclosed on September 29, 2026, and is rated with a Medium severity level. The status of this vulnerability is “Analyzed”, indicating that it has been thoroughly investigated and understood by the security community.<\/p>\n The vulnerability impacts several versions of the Joomla! Content Management System. Specifically, if you are running any of the following versions, your site is at risk:<\/p>\n It’s crucial for administrators to verify their current Joomla! installation version to determine if they are affected.<\/p>\n The vulnerability has been thoroughly analyzed, and the Joomla! security team has provided specific solutions. The issue stems from the With a CVSS score of 5.3, this vulnerability is classified as Medium severity. While it doesn’t immediately grant full control over your website, the ability for unauthorized users to create accounts poses a significant risk. These newly created accounts, even if initially at a “guest-level,” could potentially be exploited further or used to bypass other security measures, making your site more susceptible to other attacks.<\/p>\n The good news is that Joomla! has released patches to address this vulnerability. To protect your website, the most important step is to update your Joomla! installation immediately to a secure version. The recommended updates are:<\/p>\n Upgrading ensures that the faulty https:\/\/developer.joomla.org\/security-centre\/1082-20260902-core-unauthorized-user-account-creation-via-profile-save-controller.html<\/p>\n https:\/\/www.joomla.org\/<\/p>\n","protected":false},"excerpt":{"rendered":" Understanding the Risk: Unauthorized Account Creation A significant security flaw has been identified in Joomla!, a popular content management system. This vulnerability could allow unauthorized individuals to create<\/p>\n","protected":false},"author":17,"featured_media":2649,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[705,980,725,1291,695],"class_list":["post-4149","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-cms-security","tag-joomla","tag-security-vulnerability","tag-unauthorized-account","tag-web-security"],"yoast_head":"\n\n
Affected Products<\/h2>\n
\n
Current Status<\/h2>\n
profile.save<\/code> controller, which failed to adequately check a user’s login status. This oversight allowed the creation of new user accounts even when the website’s user registration feature was explicitly disabled, a critical setting for many sites aiming to restrict new account sign-ups.<\/p>\nSeverity Level<\/h2>\n
Possible Solutions<\/h2>\n
\n
profile.save<\/code> controller is replaced with a secured version that correctly enforces login state checks, preventing unauthorized account creation. Regularly updating your CMS is a fundamental cybersecurity best practice to safeguard against known vulnerabilities like this one.<\/p>\nReferences<\/h2>\n