An improper access check in Joomla! CMS’s com_modules component allows any visitor to view a list of modules displayed on the site’s front‑end. The exposed information can reveal module names, configurations and the overall architecture of the site, providing attackers with useful context for further discovery or targeted attacks. The flaw is classified as CWE‑284 and does not provide direct code execution or privilege escalation, but it does provide actionable information.

All Joomla! CMS installations that include the com_modules component and have not applied the vendor’s security fix are vulnerable. The vendor list indicates that the Joomla! Project’s Joomla! CMS product is affected. No specific version details are supplied, suggesting that all releases of the component that have not been updated are at risk.

The CVSS score of 6.4 indicates a moderate severity issue. The EPSS score of less than 1% denotes a very low current exploitation likelihood. The vulnerability is not listed in CISA’s KEV catalog. The most likely attack vector is the public web front‑end, as an unauthenticated user can trigger the disclosure simply by requesting the module‑listing page. The information obtained could aid subsequent attacks but does not alone compromise confidentiality, integrity or availability of the system.