An improper access control check in the Joomla! CMS allows users without proper permissions to perform edit actions on otherwise protected items. This flaw is located in the handling of webservice edit tasks and lets attackers alter content, settings, or other resources that would normally remain unmodifiable. Potential consequences include defacement, data tampering, or further lateral movement within the site.

Vulnerable Joomla! CMS installations from version 4.0.0 through 5.4.8 and from 6.0.0 through 6.1.3 are affected. Any site running these releases in a webservice or API mode that accepts edit requests is at risk unless mitigated by later versions or custom patches.

The CVSS score of 7 indicates a moderate to high severity. The flaw can be exploited by sending HTTP POST requests to the API endpoints that trigger edit actions. The likely attack vector is such HTTP POST requests to the vulnerable webservice API endpoints. EPSS is not available, so the precise likelihood is unknown, and it is not listed in CISA KEV. Due to the nature of the flaw, preventing exploitation mainly relies on applying a patch or disabling the vulnerable webservice routes.