Improper access control checks in Joomla webservice endpoints allow an unauthenticated or privileged user to create custom fields for components they should not manage. This flaw, classified as CWE‑284, can lead to unauthorized data exposure, data integrity violations, and potential misuse of component functionality by attackers. The attacker can inject fields that may store malicious content or be used to manipulate component behavior, impacting the confidentiality and integrity of site data.

The vulnerability affects Joomla CMS versions between 4.0.0 and 5.4.7, as well as 6.0.0 to 6.1.2. Any site running one of these releases hosts the vulnerable webservice endpoints and may allow unauthenticated users to create custom fields for otherwise protected components.

The CVSS score of 5.1 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves sending crafted HTTP requests to the webservice endpoints, exploiting the missing ACL checks to create fields without proper authorization. The exploitability depends on the attacker’s ability to reach these endpoints and the level of webserver exposure.