CVE-2026-76600

Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik < 4.7.2

View on CVE.org
Published Aug 22, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik < 4.7.2 - The DeleteComment endpoint did not perform any access checks.

Analysis

AI-generated

Technical impact

The DeleteComment endpoint does not perform any access checks, allowing any user to delete any comment in Fabrik versions older than 4.7.2. This results in loss of data integrity and potential defacement or loss of user feedback. The weakness is an unauthorized deletion control flaw (CWE-284).

Affected Systems

The vulnerability affects the Fabrik extension for Joomla provided by fabrikar.com for all versions prior to 4.7.2. No specific sub‑versions are listed, so any installation using a vulnerable release is impacted.

Risk and Exploitability

With a CVSS score of 6.9 the risk is moderate. The EPSS score is not reported, and the flaw is not currently listed in CISA KEV. The endpoint is accessible without authentication, so an attacker can trigger deletion remotely by sending a request to DeleteComment. No additional conditions are specified in the report.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Fabrik extension to version 4.7.2 or newer.
  • If an upgrade is not feasible, limit the DeleteComment endpoint to users with administrative privileges or apply an IP whitelist to restrict access.
  • Modify Fabrik settings to disable DeleteComment for non‑admin roles.

Generated by OpenCVE AI on August 22, 2026 at 15:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
References
Link Providers
https://www.fabrikar.com/ cve-icon cve-icon
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Fabrikar.com
Fabrikar.com fabrik Extension For Joomla
Vendors & Products Fabrikar.com
Fabrikar.com fabrik Extension For Joomla
Type Values Removed Values Added
Description Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik < 4.7.2 - The DeleteComment endpoint did not perform any access checks.
Title Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik < 4.7.2
Weaknesses CWE-284
References
Metrics cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
Joomla
Published
Updated
Aug 24, 2026, 1:07 PM
Reserved
Aug 19, 2026, 2:48 PM

View source JSON

Updated
Aug 24, 2026, 12:52 PM

JSON

Status
Deferred
Published
Aug 22, 2026, 3:16 PM
Modified
Oct 23, 2026, 10:10 PM

View source JSON

No data.

Updated
Aug 22, 2026, 4:00 PM

JSON