An improper ACL check in Joomla! CMS allows an attacker to execute mutation actions on access level endpoints. The defect permits actions such as creating, modifying, or deleting user access levels without proper authorization, potentially compromising the entire site's permission structure. The flaw is categorized under CWE-284, which denotes a lack of adequate access control.

The vulnerability affects Joomla! CMS versions 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3. Users running any of these releases should verify the exact build number against the affected range. The problem originates in the core module that handles webservice requests for access level management.

The CVSS score of 7 indicates high severity. EPSS data is not available, so exploit likelihood is unknown, but the flaw does not rely on privileged conditions; it can be triggered by any authenticated or unauthenticated user that can reach the webservice endpoint. Based on the description, the likely attack vector is a remote HTTP request to the exposed webservice endpoints. The vulnerability is not listed in CISA KEV, yet it is publicly documented and potentially exploitable via standard HTTP requests to the affected endpoints.