PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-72532 Joomla CVE debrief

The Joomla! Core has an Improper ACL checks vulnerability in category webservice endpoints, affecting versions 4.0.0-5.4.7 and 6.0.0-6.1.2. This allows unauthorized users to create categories via webservices endpoints. Affected deployments should prioritize updates and verify ACL checks. The vulnerability has a CVSS score of 5.1 and a severity of MEDIUM. The CVE record was published on 2026-08-18T16:18:16.593Z and has not been modified since then.

Vendor
Joomla
Product
Joomla! Core
CVSS
MEDIUM 5.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-18
Original CVE updated
2026-09-03
Advisory published
2026-08-18
Advisory updated
2026-09-03

Who should care

Joomla! Core users and administrators, security teams, and vulnerability management teams should review and apply updates. Additional stakeholders include operators managing Joomla! Core deployments and security teams monitoring for potential exploitation attempts. Affected operator, platform, vulnerability-management, and security-team impact should be reviewed.

Technical summary

The Joomla! Core has an Improper ACL checks vulnerability in category webservice endpoints, affecting versions 4.0.0-5.4.7 and 6.0.0-6.1.2. This allows unauthorized users to create categories via webservices endpoints. Affected deployments should prioritize updates and verify ACL checks. The vulnerability has a CVSS score of 5.1 and a severity of MEDIUM.

Defensive priority

Medium-priority defensive review recommended due to Improper ACL checks vulnerability in Joomla! Core.

Recommended defensive actions

  • Review and apply Joomla! Core updates to versions 5.4.8 or later, or 6.1.3 or later.
  • Verify and enforce proper ACL checks for category webservice endpoints.
  • Monitor for unauthorized category creation via webservices endpoints.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

Evidence from official CVE Program record and NIST NVD vulnerability detail page supports Improper ACL checks vulnerability in Joomla! Core versions 4.0.0-5.4.7 and 6.0.0-6.1.2. Additional verification tasks include reviewing vendor advisories and checking for unauthorized category creation via webservices endpoints.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-72532 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-72532

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-72532 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-72532

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.