The vulnerability resides in the Fabrik Joomla extension, version 4.7.2 and earlier, where the onGetEmail endpoint does not perform any access checks. An attacker who knows or can guess the endpoint URL can retrieve the email address of any commenter without authentication, exposing personal data and providing a vector for spam or phishing attacks. This weakness is a classic example of improper access control (CWE-284).

Affected systems are installations of the Fabrik extension from fabrikar.com for Joomla PHP CMS. Versions earlier than 4.7.2 are vulnerable. There is no evidence that later versions are affected and vendors state that 4.7.2 or newer contains the fix.

The CVSS score of 6.9 indicates medium severity, and the lack of an EPSS score suggests no known exploitation data yet. Because the endpoint can be queried by anyone with network access to the site, the attack vector is likely straightforward: a simple HTTP request to the onGetEmail URL. The vulnerability is not listed in the CISA KEV catalog, meaning no publicly documented exploits exist, but the lack of authentication makes it an attractive target for privacy‑oriented attackers.