Joomla! has identified a security concern where certain versions of its core content management system (CMS) were not properly checking user access permissions. This oversight could lead to sensitive contact information being exposed within a website’s underlying data structure, known as schema.org snippets, even if those contact details were meant to be private or restricted.<\/p>\n
Essentially, access control lists (ACLs) are like digital gatekeepers, ensuring that only authorized users or processes can view specific information. In this case, the gatekeepers in Joomla! weren’t always doing their job correctly, allowing contact data for items that should have been inaccessible to slip into the schema.org output. Schema.org is a collaborative effort to create structured data markups that websites can use to provide search engines with rich, detailed information, like contact details for businesses or individuals.<\/p>\n
Product Name:<\/strong> Joomla! Core<\/p>\n Published Date:<\/strong> August 18, 2026<\/p>\n Severity:<\/strong> Medium<\/p>\n Status:<\/strong> Analyzed<\/p>\n This vulnerability impacts specific versions of the Joomla! CMS. Users running the following versions should take immediate action:<\/p>\n The vulnerability (CVE-2026-73372) has been fully analyzed by the Joomla! Security Strike Team. A fix has been released, and users are strongly encouraged to update their installations.<\/p>\n Rated as Medium<\/b> severity, this vulnerability could potentially expose contact information that was intended to be private. While it doesn’t typically allow for full system takeover or remote code execution, the unauthorized disclosure of information is a significant concern for data privacy and compliance. Organizations handling sensitive contact details should prioritize addressing this issue promptly.<\/p>\n Fortunately, a solution is available. To remediate this improper ACL checks vulnerability, Joomla! users should upgrade their installations to the patched versions:<\/p>\n Always ensure you back up your website before performing any updates.<\/p>\n https:\/\/developer.joomla.org\/security-centre\/1076-20260809-core-improper-acl-checks-when-injection-schema-org-contact-data.html<\/p>\n https:\/\/www.joomla.org\/<\/p>\n","protected":false},"excerpt":{"rendered":" Unmasking Private Data: Joomla! Core Improper ACL Checks Vulnerability Joomla! has identified a security concern where certain versions of its core content management system (CMS) were not properly<\/p>\n","protected":false},"author":17,"featured_media":2649,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[1316,1317,980,1312,695],"class_list":["post-4311","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-acl","tag-data-protection","tag-joomla","tag-joomla-cms","tag-web-security"],"yoast_head":"\nAffected Products<\/h2>\n
\n
Current Status<\/h2>\n
Severity Level<\/h2>\n
Possible Solutions<\/h2>\n
\n
References<\/h2>\n