CVE-2026-78084CWE-284CWE-352broken-access-controlcsrf

CVE-2026-78084

published September 10, 2026

CVSS
6.9
EPSS
0%
Percentile
24.3
In the wild
Unconfirmed
What it is

Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property < 4.1.4 - The gallery management controller tasks lacked authorization checks and CSRF token validation.. Users could invoke file removal actions with arbitrary path strings or upload unverified file types.

The record
Technical detail
CVSS
6.9 · NONE
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L
EPSS
0.00325 · 24.3th percentile
Weaknesses
CWE-284 · Improper Access Control; CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2026-09-10T14:17Z
References (1)
https://www.joomshaper.com/joomla-extensions/sp-property · [email protected]
EPSS history
Timeline
  • 11 SEP 03:19Z
    EPSS moved — → 0%
    epss
  • 10 SEP 10:00Z
    Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property < 4.1.4
    cvelistv5