A flaw in the profile.save controller of Joomla! prevents the system from verifying whether a caller is authenticated, allowing attackers to create guest‑level user accounts without needing to log in. The vulnerability is a classic CWE‑639 scenario where the system fails to enforce state validation, which means an attacker could potentially create an account and then use it for further interactions or targeted attacks. While the accounts have only guest privileges, the ability to generate new accounts can be leveraged to bypass other access restrictions or to facilitate denial‑of‑service or phishing attempts against legitimate users.

The Joomla! CMS from the Joomla! Project is impacted. All releases from 1.5.0 through 5.4.8 and from 6.0.0 through 6.1.3 contain this flaw.

With a CVSS score of 6.9, the vulnerability is considered medium to high severity. The EPSS score is not available, so the current likelihood of exploitation cannot be quantified, and it is not listed in the CISA KEV catalog. Attackers can exploit the flaw by sending an unauthenticated request to the profile.save endpoint, causing the system to create a new guest‑level user account. No additional conditions or privileges are required beyond the ability to reach the vulnerable URL.