CVE-2026-72532

MediumCVSS 5.1

Published: 18/08/2026(UTC)Updated: 18/08/2026(UTC)Translated: 18/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.32%

25th percentile - higher than 25% of all known CVEs

Summary

Joomla! Core versions 4.0.0-5.4.7 and 6.0.0-6.1.2 have improper ACL checks for category webservice endpoints. An improper access check allows unauthorized users to create categories via webservices endpoints.

Risk Assessment

Unauthorized users can create categories, potentially leading to unauthorized changes in content structure.

Recommendation

Update Joomla! to a version containing the fix (5.4.8 or later, 6.1.3 or later).

Original NVD description (English source)

Joomla! Core - [20260806] - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to create categories via webservices endpoints.