Description
Joomla! Core - [20260906] - Core - Improper ACL checks in content history comparison view in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to view inaccessible contents.
Published: 2026-09-29
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Viewing of Restricted Content
Action: Apply Patch
AI Analysis

Impact

The Joomla! core flaw involves improper ACL checks in the content history comparison view, allowing users to see the history of pages they are not normally permitted to view. This grants unauthorized access to potentially sensitive or private information, constituting an information disclosure vulnerability (CWE-284).

Affected Systems

The vulnerability affects Joomla! CMS releases 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3 of the core component. All installations using any of these version ranges are susceptible until the patch is applied.

Risk and Exploitability

With a CVSS score of 5.1 the flaw is considered moderate, and no EPSS data or KEV listing is available. The likely attack vector is through the web interface; any user who can reach the content history comparison page can trigger the exploit without additional authentication, potentially exposing restricted content to a wide audience.

Generated by OpenCVE AI on September 30, 2026 at 00:46 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Joomla! CMS to the latest release that includes the ACL fix (earlier than 5.4.9 or 6.1.4).
  • Restrict or disable the content history comparison view for roles that do not require it, ensuring ACLs enforce the intended restrictions.
  • Review and audit ACL configurations to verify that no unintended permissions grant access to the history feature.

Generated by OpenCVE AI on September 30, 2026 at 00:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 06 Oct 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Joomla joomla\!
CPEs cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*
Vendors & Products Joomla joomla\!
Metrics cvssV3_1

{'score': 2.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N'}

Wed, 30 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 30 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Joomla
Joomla joomla!
Vendors & Products Joomla
Joomla joomla!

Tue, 29 Sep 2026 16:45:00 +0000

Type Values Removed Values Added
Description Joomla! Core - [20260906] - Core - Improper ACL checks in content history comparison view in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to view inaccessible contents.
Title Joomla! Core - [20260906] - Core - Improper ACL checks in content history comparison view in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
Weaknesses CWE-284
References
Metrics cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Joomla Joomla! Joomla\!
cve-icon MITRE

Status: PUBLISHED

Assigner: Joomla

Published:

Updated: 2026-10-01T04:45:57.117Z

Reserved: 2026-09-14T11:03:59.813Z

Link: CVE-2026-90916

cve-icon Vulnrichment

Updated: 2026-09-30T19:33:33.154Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-29T17:17:13.643

Modified: 2026-10-06T16:34:43.077

Link: CVE-2026-90916

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-30T20:41:14Z

Weaknesses