The Fabrik extension for Joomla contains a missing access control check in its download element that allows anyone to request file downloads without proper authorization. This flaw is a classic instance of CWE‑284 (Improper Access Control). Consequently, attackers could retrieve any file the extension can access, potentially exposing sensitive information or secret code to unauthenticated users.

The affected vendor is fabrikar.com, offering the Fabrik extension for the Joomla CMS. Versions of the extension older than 4.7.2 contain the vulnerability; versions 4.7.2 and later have the ACL check in place and are not affected by this flaw.

The vulnerability is rated with a CVSS score of 10, indicating critical severity. No EPSS score is available, so the concrete exploitation probability is unknown, but the issue remains high risk. The flaw is not listed in the CISA KEV catalog. Attackers can exploit the missing ACL by submitting a simple HTTP request to the download endpoint, thereby fetching files without permission.