The vulnerability is an improper access control check that allows an unauthorized user to view content items from categories that should be inaccessible. This flaw is classified under CWE-284 and results in unauthorized disclosure rather than code execution or denial of service. The impact is limited to the confidentiality of CMS content, giving attackers the ability to read hidden or protected articles, blog posts, or other content types.

Joomla! CMS versions 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3 are affected. Users running the Joomla! core in those version ranges should verify the installed version and apply the appropriate update from the Joomla! Project.

The CVSS score is 6.9, indicating a moderate severity. No EPSS score is available, so the exploitation probability is unclear, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via web requests to the system because the flaw occurs when generating outputs for tagged items. An attacker could craft a request that references a tag linked to an inaccessible category, causing the system to return the protected content without performing proper ACL checks.