CVE-2026-35223 HIGH

CVE-2026-35223: Joomla! Core - [20260508] - Improper access check in com_config webservice endpoints

Vendor Joomla! Project
Product Joomla! CMS
Weakness CWE-284
Published May 26, 2026
Last update May 27, 2026
View on NVD All CVEs

CVSS base score

8.6/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

An improper access check allows unauthorized access to com_config webservice endpoints.

Explanation of Vulnerability in Simple Terms

02Summary

Joomla! CMS versions 4.0.0 through 5.4.5 contain an access control flaw that allows high-privilege users to perform unauthorized actions. An attacker with administrative credentials can bypass intended restrictions to read or modify sensitive data. The vulnerability requires valid admin-level access to exploit and does not affect confidentiality or availability of the broader system.

What an attacker can do

03Attacker Capabilities

Read or modify sensitive data if they have admin-level access to the site.

Potential impact on your site

04Site Impact

Admins or compromised admin accounts can access data beyond their intended permissions.

Conditions required to exploit

05Prerequisites

Attacker must have high-privilege (admin) credentials; no user interaction required.

Key dates

06Disclosure timeline

May 26, 2026 CVE published
May 27, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2024-8269 MStore API – Create Native Android & iOS Apps On The Cloud <= 4.15.3 - Unauthorized User Registration CVE-2024-10393 Tutor LMS <= 2.7.6 - User Registration Setting Bypass to Unauthorized User Registration CVE-2025-6680 Tutor LMS <= 3.8.3 - Missing Authorization to Sensitive Information Exposure CVE-2023-6966 The Moneytizer <= 9.6.3 - Missing Authorization via multiple AJAX actions CVE-2024-12294 Last Viewed Posts by WPBeginner <= 1.0.1 - Unauthenticated Sensitive Information Exposure