What the vulnerability does
01Description
An improper access check allows unauthorized access to webservice endpoints.
CVE-2026-23899
HIGH
CVE-2026-23899: Joomla! Core - [20260306] - Improper access check in webservice endpoints
CVSS base score
8.6/10
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Explanation of Vulnerability in Simple Terms
02Summary
Joomla! CMS versions 4.0.0 through 5.4.3 contain an access control flaw that allows high-privilege users to perform unauthorized actions. An attacker with administrative credentials can bypass intended restrictions to read or modify sensitive data. The vulnerability requires valid admin-level access and does not affect confidentiality, integrity, or availability of the broader system.
What an attacker can do
03Attacker Capabilities
A high-privilege user can bypass access restrictions to read or modify data they should not access.
Potential impact on your site
04Site Impact
Admins with compromised credentials can access restricted data; review admin account activity and audit access logs.
Conditions required to exploit
05Prerequisites
Attacker must have valid Joomla administrator credentials.
Key dates
06Disclosure timeline
April 1, 2026
CVE published
April 2, 2026
Record updated
External resources
07References
Related vulnerabilities
08Related CVE
CVE-2024-13854 Education Addon for Elementor <= 1.3.1 - Authenticated (Contributor+) Insecure Direct Object Reference via naedu_elementor_template Shortcode
CVE-2026-48898 Joomla! Core - [20260513] - Privilege escalation through com_users batch task
CVE-2026-21629 Joomla! Core - [20260301] - ACL hardening in com_ajax
CVE-2024-13635 VK Blocks <= 1.94.2.2 - Missing Authorization to Sensitive Information Exposure
CVE-2024-5331 Breakdance <= 1.7.2 - Missing Authorization
