CVE-2026-72531

MediumCVSS 5.1

Published: 18/08/2026(UTC)Updated: 18/08/2026(UTC)Translated: 18/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.32%

25th percentile - higher than 25% of all known CVEs

Summary

Joomla! Core has an improper ACL check for custom fields webservice endpoints. Unauthorized users can create fields for inaccessible components.

Risk Assessment

Unauthorized users can modify custom field configuration, potentially leading to unauthorized changes or data integrity issues.

Recommendation

Update Joomla! to a version where the ACL check for custom fields webservice is fixed.

Original NVD description (English source)

Joomla! Core - [20260804] - Improper ACL checks for custom fields webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to create fields for inaccessible components.