An improper access check in the Joomla! core com_config webservice endpoints allows an attacker to bypass normal authentication and obtain unauthorized access to configuration settings. This flaw can enable the attacker to modify or retrieve sensitive configuration data, potentially leading to full control over the affected Joomla! installation. The weakness is rooted in inadequate authorization enforcement, classified as CWE‑284.

The flaw affects the Joomla! CMS provided by the Joomla! Project. Specific affected release versions are not listed in the advisory; administrators should consult the vendor security notice to determine if their installation is vulnerable and to apply any available patch.

The vulnerability carries a CVSS score of 8.6, indicating a high impact level. Exploitation is likely feasible over the network via the exposed webservice endpoints, so the risk is high for publicly accessible sites. Since EPSS is below 1% and the flaw is not listed in the CISA KEV catalog, there is no current evidence of widespread exploitation, but the high CVSS score warrants immediate attention. The attack vector is inferred to be remote, utilizing HTTP requests to the vulnerable endpoints. The lack of detailed version information means the true scope could be broader than reported.