The Joomla! AJAX component failed to enforce the default logged‑in user check within the administration interface. This oversight permits any user, including unauthenticated or insufficiently privileged accounts, to invoke administrative AJAX actions. The consequence is a privilege escalation to gain administrative capabilities, potentially allowing modification or disclosure of sensitive site data. The weakness is classified as an access control bypass under CWE‑284.

The affected product is Joomla! CMS from the Joomla! Project. No specific affected version range is listed, but the issue applies to all releases prior to the fix that introduced ACL hardening in the com_ajax component. Administrators should verify that they are running the patched version or a release that includes the hardening.

The CVSS score is 6.3, indicating moderate severity. The EPSS score is below 1%, suggesting a low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. Based on the description, the attack would most likely involve sending a web request to the com_ajax endpoint, though the exact network details are not explicitly documented, so the attack vector is inferred. Overall, organizations that can promptly patch can reduce the risk to a manageable level.