CVE-2026-73372CWE-284broken-access-control

CVE-2026-73372

Medium · published August 18, 2026

CVSS v3.1

4.3

EPSS

Percentile

19.9

In the wild

Unconfirmed

What it is

Joomla! Core - [20260809] - Improper ACL checks when injection schema.org contact data in Joomla 5.1.0-5.4.7 and 6.0.0-6.1.2 - An improper access check injects contact information for unaccessible contact items into schema.org snippets.

The record

Technical detail

CVSS v3.1: 4.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0: 5.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS: 0.00285 · 19.9th percentile
Weakness: CWE-284 · Improper Access Control
Published: 2026-08-18T21:17Z

Affected products (2)

Product	Versions	Fixed in
joomla/joomla\!	≥ 5.1.0, < 5.4.8	5.4.8
joomla/joomla\!	≥ 6.0.0, < 6.1.3	6.1.3

References (2)

https://developer.joomla.org/security-centre/1076-20260809-core-improper-acl-checks-when-injection-schema-org-contact-data.html · [email protected]https://www.joomla.org/ · [email protected]

EPSS history

Timeline

18 AUG 16:05Z
Joomla! Core - [20260809] - Improper ACL checks when injection schema.org contact data in Joomla 5.1.0-5.4.7 and 6.0.0-6.1.2
cvelistv5