CVE-2026-21629CWE-284

Joomla! Core - [20260301] - ACL hardening in com_ajax

Medium · published April 1, 2026

CVSS v4.0
6.3
EPSS
0%
Percentile
15.4
In the wild
Unconfirmed
What it is

The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party developers.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00249 · 15.4th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-04-01T09:03Z
EPSS history
Timeline
  • 01 APR 09:03Z
    Joomla! Core - [20260301] - ACL hardening in com_ajax
    cvelistv5