CVE-2026-35223 Overview
CVE-2026-35223 is an improper access control vulnerability in Joomla's com_config component webservice endpoints. The flaw allows authenticated users to bypass access checks and reach configuration endpoints they should not be able to query. Joomla disclosed the issue in Security Advisory 1040, classifying it under CWE-284: Improper Access Control. The vulnerability affects Joomla core installations exposing the API webservices interface. Successful exploitation impacts confidentiality, integrity, and availability of the affected Joomla instance.
Critical Impact
Authenticated attackers can access protected com_config webservice endpoints, exposing site configuration data and enabling unauthorized changes to Joomla core settings.
Affected Products
- Joomla! CMS core (versions referenced in Joomla Security Advisory 1040)
- Joomla installations with the API webservices interface enabled
- The com_config component webservice endpoints
Discovery Timeline
- 2026-05-26 - CVE-2026-35223 published to NVD
- 2026-05-26 - Last updated in NVD database
- Reference - Joomla Security Advisory 1040
Technical Details for CVE-2026-35223
Vulnerability Analysis
The vulnerability resides in the access check logic for com_config webservice endpoints. Joomla exposes a REST-style API that maps core components to webservice routes. The com_config component manages global configuration and component-level settings. The access check on these routes does not correctly validate caller permissions before serving the response.
An attacker who holds valid credentials on the target Joomla instance can issue API requests against com_config routes. The endpoints return or accept configuration data without enforcing the privilege level normally required by the administrator backend. The defect is classified under [CWE-284], indicating that authorization logic is present but applied incorrectly.
The attack vector is network-based with low complexity. High privileges are required for exploitation, which aligns with the requirement for a valid API token or authenticated session. No user interaction is required once a valid session is established.
Root Cause
The root cause is an incomplete authorization check in the webservice layer that wraps com_config. The backend administrator UI enforces capability checks for configuration changes, but the equivalent API route handlers omit or short-circuit the same checks. As a result, the privilege boundary between administrator and lower-privileged authenticated roles collapses for these endpoints.
Attack Vector
An authenticated attacker sends HTTP requests to the Joomla API endpoints associated with com_config. Because the access check is improper, the server processes the request as if the caller were authorized. The attacker can enumerate configuration values, retrieve sensitive settings, or submit modifications. Verified proof-of-concept code is not publicly available. Refer to Joomla Security Advisory 1040 for vendor technical detail.
Detection Methods for CVE-2026-35223
Indicators of Compromise
- Unexpected HTTP requests to /api/index.php/v1/config/* routes from non-administrator accounts.
- Audit log entries showing configuration reads or writes performed via the webservice API rather than the administrator backend.
- New or modified Joomla API Bearer tokens associated with low-privileged user accounts.
Detection Strategies
- Review Joomla access logs for com_config API route activity and correlate the requesting user against expected administrator accounts.
- Alert on HTTP 200 responses to /api/index.php/v1/config/ paths originating from user agents or IPs that have not historically accessed the admin interface.
- Compare current Joomla global configuration values against a known-good baseline to detect unauthorized changes.
Monitoring Recommendations
- Enable verbose webserver and Joomla audit logging for all /api/ routes and forward logs to a centralized SIEM.
- Track authentication events for API tokens and flag tokens issued to non-administrator roles that subsequently query configuration endpoints.
- Monitor outbound changes to configuration.php and component parameters on the file system and in the database #__extensions table.
How to Mitigate CVE-2026-35223
Immediate Actions Required
- Apply the Joomla core update referenced in Joomla Security Advisory 1040 as soon as it is available for your branch.
- Audit all Joomla API tokens and revoke any tokens that are not actively required.
- Restrict access to the /api/ endpoint at the webserver or WAF layer to trusted IP ranges where feasible.
Patch Information
Joomla published the fix in Security Advisory 1040, dated 2026-05-08. Administrators should upgrade to the patched Joomla core release identified in the advisory. The patch corrects the access check on com_config webservice routes so that requests are evaluated against the same capability requirements enforced by the administrator backend.
Workarounds
- Disable the Joomla API application if webservices are not required, by unpublishing the API plugin set.
- Block external access to /api/index.php/v1/config/ paths using webserver rewrite rules or a WAF policy until the patch is applied.
- Reduce the number of accounts with elevated privileges and rotate credentials for any user that holds API access.
# Example Apache rule to block external access to com_config API routes
<LocationMatch "^/api/index\.php/v1/config/">
Require ip 10.0.0.0/8
Require ip 192.168.0.0/16
</LocationMatch>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
