ZeroDay Findings
Sign inSign up

Findings

CVE-2026-90907

[20260902] - Core - Unauthorized user account creation via profile.save controller

Published Sep 25, 2026 · Joomla Joomla

Project: Joomla! SubProject: CMS Impact: Moderate Severity: Moderate Probability: Moderate Versions: 1.5.0-5.4.8,6.0.0-6.1.3 Exploit type: Authorization Bypass Through User-Controlled Key Reported Date: 2026-08-09 Fixed Date: 2026-09-25 CVE Number: CVE-2026-90907 Description The profile.save controller did not check the login state of a user, allowing the creation of guest-level users on sites without active user registration. Affected Installs Joomla! CMS versions 1.5.0-5.4.8, 6.0.0-6.1.3 Solution Upgrade to version 5.4.9, 6.1.4 Contact The JSST at the Joomla! Security Centre . Reported By: A

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Sep 25, 2026 · Joomla Security

    Detected

    Project: Joomla! SubProject: CMS Impact: Moderate Severity: Moderate Probability: Moderate Versions: 1.5.0-5.4.8,6.0.0-6.1.3 Exploit type: Authorization Bypass Through User-Controlled Key Reported Date: 2026-08-09 Fixed Date: 2026-09-25 CVE Number: CVE-2026-90907 Description The profile.save controller did not check the login state of a user, allowing the creation of guest-level users on sites wit

Sources

  • Joomla SecurityVendor advisoryCVE-2026-90907

    Project: Joomla! SubProject: CMS Impact: Moderate Severity: Moderate Probability: Moderate Versions: 1.5.0-5.4.8,6.0.0-6.1.3 Exploit type: Authorization Bypass Through User-Controlled Key Reported Date: 2026-08-09 Fixed Date: 2026-09-25 CVE Number: CVE-2026-90907 Description The

    developer.joomla.org