CVE-2026-73372 Joomla! Project CVE debrief

Who should care

Joomla! Core users and administrators, as well as security teams and vulnerability management teams, should review and apply updates to prevent potential exploitation of this vulnerability. Additionally, operators and platform administrators may need to verify and enforce proper access controls for schema.org contact data injection. Security teams should monitor for potential exploitation attempts and review compensating controls for exposed systems while remediation is scheduled and verified. This vulnerability may impact organizations using Joomla! Core versions 5.1.0-5.4.7 and 6.0.0-6.1.2, and they should take necessary precautions to prevent exploitation. The vulnerability has a CVSS score of 5.1 and a severity rating of MEDIUM, indicating a moderate level of risk. Users should prioritize reviewing and applying updates to prevent potential exploitation. Furthermore, users should verify and enforce proper access controls for schema.org contact data injection to prevent unauthorized data injection. This may involve reviewing and updating access control lists, monitoring for suspicious activity, and implementing additional security measures as needed. By taking these steps, users can help prevent potential exploitation of this vulnerability and protect their systems from unauthorized data injection. It is also recommended that users review compensating controls for exposed systems while remediation is scheduled and verified, and monitor for potential exploitation attempts to quickly detect and respond to potential security incidents. Overall, Joomla! Core users and administrators, as well as security teams and vulnerability management teams, should take immediate action to review and apply updates, verify and enforce proper access controls, and monitor for potential exploitation attempts to prevent potential exploitation of this vulnerability. This may involve coordinating with IT teams, security teams, and other stakeholders to ensure that necessary precautions are taken to prevent exploitation. By prioritizing the review and application of updates, verification and enforcement of proper access controls, and monitoring for potential exploitation attempts,users

Technical summary

The Joomla! Core has an improper access check that injects contact information for unaccessible contact items into schema.org snippets. This issue affects Joomla! Core versions 5.1.0-5.4.7 and 6.0.0-6.1.2. The vulnerability is caused by inadequate access controls, allowing unauthorized data injection. Users should review and apply updates to prevent potential exploitation.

Defensive priority

Medium-priority defensive review recommended due to Improper ACL checks vulnerability in Joomla! Core.

Recommended defensive actions

• Review and apply Joomla! Core updates to versions 5.1.0-5.4.8 and 6.0.0-6.1.3 or later
• Verify and enforce proper access controls for schema.org contact data injection
• Monitor for potential exploitation attempts

Evidence notes

Evidence from official CVE Program record and NIST NVD detail page supports Improper ACL checks vulnerability in Joomla! Core versions 5.1.0-5.4.7 and 6.0.0-6.1.2. The vulnerability allows for contact information injection into schema.org snippets due to improper access controls. Defenders should verify affected versions, review access controls, and monitor for potential exploitation attempts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.