An improper access control check within the com_privacy component of the Joomla! CMS allows attackers to retrieve private user data via webservice endpoints without authentication. This flaw, identified as CWE‑284 (and other unspecified weaknesses indicated by NVD-CWE-noinfo), permits the disclosure of sensitive privacy information and represents a direct breach of confidentiality.

The Joomla! CMS from the Joomla! Project is affected. No specific version numbers are provided, so any installation that includes the com_privacy component is potentially vulnerable until a vendor patch is released. Administrators should verify whether the component is deployed and whether the CMS version is older than the latest security release.

The CVSS score of 6.4 classifies the defect as medium severity. An EPSS score of < 1% indicates a very low but non‑zero exploitation probability, and the vulnerability is not listed in CISA KEV. Based on the description, it is inferred that attackers could exploit the flaw by sending unauthenticated HTTP requests to the exposed webservice endpoints to retrieve privacy datasets, resulting in confidentiality loss without reported integrity or availability impacts.