CVE-2026-72531 Joomla! Project CVE debrief

Who should care

Joomla! Core administrators and users, security teams responsible for web application security, and developers using Joomla! Core should review and apply vendor patches for affected versions. They should also verify and enforce proper access controls for custom fields webservice endpoints and monitor for unauthorized field creation attempts. Additionally, security teams should consider compensating controls for exposed systems while remediation is scheduled and verified. Asset inventory and change management processes should be reviewed to ensure timely updates and mitigations. Monitoring and detection capabilities should be checked for exposed assets that need extra review. Rollback and change window management strategies should be evaluated to minimize potential impact. Source tracking and vulnerability management processes should be updated to reflect this vulnerability and ensure ongoing protection. This vulnerability has a medium CVSS score of 5.1 and is classified as MEDIUM severity. The vulnerability was published on 2026-08-18T17:17:02.477Z and has not been modified since then. The NVD entry is currently Analyzed. The CVE record was published on 2026-08-18T17:17:02.477Z and has not been modified since then. The NVD entry is currently Analyzed. Joomla! Core versions 4.0.0-5.4.7, 6.0.0-6.1.2 are affected by this vulnerability. Improper ACL checks for custom fields webservice endpoints allow unauthorized users to create fields for inaccessible components. This vulnerability impacts web application security, particularly for Joomla! Core administrators and users. Security teams should review and enforce proper access controls for custom fields webservice endpoints. Compensating controls for exposed systems should be considered while remediation is scheduled and verified. Asset inventory and change management processes should be reviewed to ensure timely updates and mitigations. Monitoring and detection capabilities should be checked for exposed assets that need extra review. Rollback and change window management strategies should be evaluated to minimize potential impact. Source tracking and vulnerability management processes should be updated to reflect and

Technical summary

The Joomla! Core is vulnerable to Improper ACL checks for custom fields webservice endpoints in versions 4.0.0-5.4.7, 6.0.0-6.1.2. An unauthorized user can create fields for inaccessible components due to an improper access check. This vulnerability impacts web application security, particularly for Joomla! Core administrators and users. Security teams should review and enforce proper access controls for custom fields webservice endpoints.

Defensive priority

Medium-priority defensive review recommended due to Improper ACL checks vulnerability in Joomla! Core.

Recommended defensive actions

• Review and apply vendor patches for Joomla! Core versions 4.0.0-5.4.7, 6.0.0-6.1.2
• Verify and enforce proper access controls for custom fields webservice endpoints
• Monitor for unauthorized field creation attempts

Evidence notes

Evidence from official CVE Program record and NIST NVD detail page supports Improper ACL checks vulnerability in Joomla! Core versions 4.0.0-5.4.7, 6.0.0-6.1.2. Vendor advisory from [email protected] provides additional context. The vulnerability allows unauthorized users to create fields for inaccessible components due to improper access checks in custom fields webservice endpoints. Defenders should verify affected versions, review access controls, and monitor for unauthorized field creation attempts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.