UpHeron
All vulnerabilities

Servers and applications

CVE-2026-71574

Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform mutation actions in webservice endpoints, where the same mutation was restricted in the backend UI.

Severity
High 8.5
Published
18 Aug 2026
Last changed
3 Sept 2026
Added to UpHeron
21 Oct 2026
Fixed in
5.4.8, 6.1.3
Sources
NVD

Affected software

SoftwareAffected versions
Joomla!Servers and applications · cpe:a:joomla:joomla\!
  • From 4.0.0 before 5.4.8
  • From 6.0.0 before 6.1.3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-71574
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-71574