CVE-2026-76610CWE-284CWE-352broken-access-controlcsrf

CVE-2026-76610

published August 20, 2026

CVSS
6.9
EPSS
0%
Percentile
12.0
In the wild
Unconfirmed
What it is

Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo < 4.1.65 - The comment controller endpoint lacked ACL checks, allowing unauthorized tag modifications by unauthenticated users.

The record
Technical detail
CVSS
6.9 · NONE
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00221 · 12.0th percentile
Weaknesses
CWE-284 · Improper Access Control; CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2026-08-20T13:16Z
References (1)
https://www.yootheme.com/ · [email protected]
EPSS history
Timeline
  • 20 AUG 08:54Z
    Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo < 4.1.65
    cvelistv5