CVE-2026-71573: Joomla Core CORS Validation Vulnerability

CVE-2026-71573 Overview

CVE-2026-71573 is an improper Cross-Origin Resource Sharing (CORS) origin validation vulnerability in Joomla! Core. The flaw affects Joomla versions 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2. An implementation defect prevents configured CORS origins from being properly validated during cross-origin requests. The weakness is classified as [CWE-93] Improper Neutralization of CRLF Sequences. Attackers can bypass the intended CORS origin allowlist over the network without authentication or user interaction.

Critical Impact
Improper CORS validation allows unauthorized origins to interact with Joomla endpoints, exposing site data and integrity to cross-origin attacks.

Affected Products

Joomla! Core 4.0.0 through 4.x
Joomla! Core 5.0.0 through 5.4.7
Joomla! Core 6.0.0 through 6.1.2

Discovery Timeline

2026-08-18 - CVE-2026-71573 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-71573

Vulnerability Analysis

The vulnerability resides in Joomla's CORS handling logic. Joomla allows administrators to configure a list of trusted origins that may issue cross-origin requests against the site. The implementation fails to correctly validate incoming Origin header values against the configured allowlist. As a result, browsers can receive CORS response headers that grant access to origins that were never authorized. This weakens the same-origin protections that CORS is meant to enforce for Joomla APIs and administrative endpoints.

Root Cause

The root cause is an improper implementation of origin comparison logic in the Joomla CORS module. Configured origins are not matched strictly against the request Origin header, allowing attacker-controlled origins to pass validation. The issue is tracked under [CWE-93] (Improper Neutralization of CRLF Sequences in HTTP Headers), indicating that header handling is central to the defect. The Joomla project documented the issue in the Joomla Security Advisory 20260802.

Attack Vector

An attacker hosts a malicious web page and lures an authenticated Joomla user to visit it. The malicious page issues cross-origin requests to the vulnerable Joomla site with a crafted Origin header. Because origin validation is broken, Joomla responds with permissive Access-Control-Allow-Origin headers. The attacker's page then reads response data or performs actions in the context of the victim's session, depending on cookie and credential handling. The attack requires no privileges and no user interaction beyond visiting the attacker-controlled page.

No public proof-of-concept code has been published. Refer to the Joomla Security Advisory for authoritative technical detail.

Detection Methods for CVE-2026-71573

Indicators of Compromise

Unexpected Access-Control-Allow-Origin response headers echoing unfamiliar origins in Joomla web server logs.
Cross-origin requests from third-party domains to Joomla REST or administrative endpoints such as /api/index.php.
Unusual Origin header values in HTTP request logs that do not match the configured Joomla allowlist.

Detection Strategies

Review Joomla and reverse-proxy access logs for requests carrying an Origin header referencing untrusted external domains.
Compare observed CORS response headers against the site's configured origin allowlist to identify mismatches.
Correlate cross-origin request bursts with authenticated administrator sessions to identify targeted browser-based attacks.

Monitoring Recommendations

Enable verbose HTTP header logging on the web server or Web Application Firewall in front of Joomla.
Alert on responses that return Access-Control-Allow-Credentials: true alongside a dynamic Access-Control-Allow-Origin value.
Monitor administrator account activity for state changes initiated shortly after cross-origin requests.

How to Mitigate CVE-2026-71573

Immediate Actions Required

Upgrade Joomla to a fixed release that addresses advisory 20260802, moving off any 4.x, 5.x through 5.4.7, or 6.x through 6.1.2 installation.
Audit the site's configured CORS origins and remove any entries that are not strictly required for site operation.
Invalidate active administrator sessions after upgrading to reduce risk from any cross-origin actions initiated prior to patching.

Patch Information

Joomla has published fix guidance in the Joomla Security Advisory 20260802. Administrators should upgrade to the fixed version identified in that advisory. Additional project information is available on the Joomla Official Website.

Workarounds

Disable CORS support in Joomla's global configuration if cross-origin API access is not required.
Enforce strict Origin header allowlisting at the reverse proxy or Web Application Firewall layer in front of Joomla.
Restrict access to Joomla administrative endpoints such as /administrator/ and /api/ to trusted IP ranges until the patch is applied.

bash

# Example nginx snippet to enforce strict Origin allowlisting in front of Joomla
map $http_origin $cors_ok {
    default                    0;
    "https://trusted.example"  1;
}

server {
    location /api/ {
        if ($cors_ok = 0) { return 403; }
        proxy_pass http://joomla_backend;
    }
}