An improper access check in Joomla! CMS allows an attacker to call protected webservice endpoints without proper authentication, potentially exposing sensitive data or enabling unintended functionality; this flaw could be exploited to modify configuration, upload content, or otherwise compromise the application.

The vulnerability affects the Joomla! CMS; no specific version constraints were listed, so any version of Joomla! CMS could be subject to the flaw until the patch is applied.

The flaw carries a CVSS score of 8.6, indicating high severity, but the EPSS score is below 1%, suggesting exploitation is unlikely at present and it is not listed in the CISA KEV catalog; the attack vector is inferred to be remote, through unauthenticated access to webservice endpoints, making the principal risk elevated for systems that expose these services without additional protection.