CVE-2021-26040

[20210801] - Core - Insufficient access control for com_media deletion endpoint

published August 24, 2021

CVSS
β€”
EPSS
1%
Percentile
60.5
In the wild
Unconfirmed
What it is

⚠️ Oops! The Joomla! media manager might just delete files without checking if you're allowed to! 🎭 Think of it like a restaurant where the waiter just tosses out orders without confirming them β€” a recipe for disaster if someone orders the last slice of cake! 🍰 An unauthorized user could sneak in and delete crucial files, leaving your website in disarray. Imagine waking up to discover your online presence is missing key ingredients β€” that’s absolutely devastating! πŸ’”

Put simply

Think of it like a restaurant where the waiter just tosses out orders without confirming them β€” a recipe for disaster if someone orders the last slice of cake! 🍰 This vulnerability arises because Joomla! 4.0.0's media manager skips verifying user permissions before executing file deletions, allowing anyone with access to delete files at will.

What to do

An unauthorized user could sneak in and delete crucial files, leaving your website in disarray. Imagine waking up to discover your online presence is missing key ingredients β€” that’s absolutely devastating! πŸ’” Upgrade to the latest version of Joomla! to fix this oversight, and review user access controls to ensure that only authorized users can delete files. It's wise to audit your permissions regularly! πŸ” You've got this! With a quick update, your site will be secure again in no time. πŸ›‘οΈ

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00936 Β· 60.5th percentile
Published
2021-08-24T14:20Z
EPSS history
Timeline
  • 24 AUG 14:20Z
    [20210801] - Core - Insufficient access control for com_media deletion endpoint
    cvelistv5