This vulnerability is an improper access control flaw that allows users who do not normally have the ability to modify content stages to change the workflow stage of content they cannot otherwise view. By changing a page’s workflow state, attackers can cause unapproved or draft content to be published, hidden, or archived without the requisite permissions, potentially manipulating public-facing information or disrupting editorial processes. The weakness corresponds to CWE-284 – Improper Access Control.

The issue affects Joomla! CMS versions 5.0.0 through 5.4.8 and 6.0.0 through 6.1.3, released by the Joomla! Project. Any site running one of these versions and using the built‑in workflow feature is likely impacted.

The CVSS score is 5.1, indicating moderate severity. The EPSS score for this item is not available, and the vulnerability is not currently listed in CISA’s KEV catalogue, so there is no evidence of widespread exploitation to date. However, because the flaw permits changing workflow stages via the website’s backend, an attacker can exploit it by simply logging into the Joomla administrator interface with any account that has editorial access but not the necessary ACL for stage changes. The attack requires legitimate authentication and can be performed using standard web forms or the Joomla API.