CVE-2026-72531
[20260804] - Core - Improper ACL checks for custom fields webservice endpoints
Published Aug 17, 2026 · Joomla Joomla
Project: Joomla! SubProject: CMS Impact: Moderate Severity: Moderate Probability: Low Versions: 4.0.0-5.4.7, 6.0.0-6.1.2 Exploit type: Incorrect Access Control Reported Date: 2026-07-06 Fixed Date: 2026-08-18 CVE Number: CVE-2026-72531 Description An improper access check allows unauthorized users to create fields for inaccessible components. Affected Installs Joomla! CMS versions 4.0.0-5.4.7, 6.0.0-6.1.2 Solution Upgrade to version 5.4.8, 6.1.3 Contact The JSST at the Joomla! Security Centre . Reported By: ebadfd
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Aug 17, 2026 · Joomla Security
Detected
Project: Joomla! SubProject: CMS Impact: Moderate Severity: Moderate Probability: Low Versions: 4.0.0-5.4.7, 6.0.0-6.1.2 Exploit type: Incorrect Access Control Reported Date: 2026-07-06 Fixed Date: 2026-08-18 CVE Number: CVE-2026-72531 Description An improper access check allows unauthorized users to create fields for inaccessible components. Affected Installs Joomla! CMS versions 4.0.0-5.4.7, 6.0
Sources
- CVE.orgVulnerability recordCVE-2026-72531
Official CVE identifier
cve.org - Joomla SecurityVendor advisoryCVE-2026-72531
Project: Joomla! SubProject: CMS Impact: Moderate Severity: Moderate Probability: Low Versions: 4.0.0-5.4.7, 6.0.0-6.1.2 Exploit type: Incorrect Access Control Reported Date: 2026-07-06 Fixed Date: 2026-08-18 CVE Number: CVE-2026-72531 Description An improper access check allows
developer.joomla.org