CVE-2026-72532CWE-284broken-access-control

CVE-2026-72532

Medium · published August 18, 2026

CVSS v3.1

5.4

EPSS

Percentile

17.3

In the wild

Unconfirmed

What it is

Joomla! Core - [20260806] - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to create categories via webservices endpoints.

The record

Technical detail

CVSS v3.1: 5.4 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0: 5.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS: 0.00264 · 17.3th percentile
Weakness: CWE-284 · Improper Access Control
Published: 2026-08-18T20:18Z

Affected products (2)

Product	Versions	Fixed in
joomla/joomla\!	≥ 4.0.0, < 5.4.8	5.4.8
joomla/joomla\!	≥ 6.0.0, < 6.1.3	6.1.3

References (2)

https://developer.joomla.org/security-centre/1072-20260805-core-improper-acl-checks-for-category-webservice-endpoints.html · [email protected]https://www.joomla.org/ · [email protected]

EPSS history

Timeline

18 AUG 16:03Z
Joomla! Core - [20260805] - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2
cvelistv5