CVE-2026-71574 Overview
CVE-2026-71574 is a broken access control vulnerability in Joomla! Core affecting versions 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2. The flaw stems from inconsistent Access Control List (ACL) checks between the backend user interface and the webservice API endpoints. Authenticated users can perform mutation actions through webservice endpoints even when the same actions are restricted in the backend UI. The vulnerability is classified under [CWE-284] Improper Access Control.
Critical Impact
Authenticated attackers with backend access can bypass UI-level restrictions and perform unauthorized mutations on Joomla content and configuration through the webservice API.
Affected Products
- Joomla! Core versions 4.0.0 through 5.4.7
- Joomla! Core versions 6.0.0 through 6.1.2
- Joomla installations exposing webservice API endpoints
Discovery Timeline
- 2026-08-18 - CVE-2026-71574 published to NVD
- 2026-08-18 - Last updated in NVD database
Technical Details for CVE-2026-71574
Vulnerability Analysis
The vulnerability originates in how Joomla enforces authorization on parallel access paths to the same resources. Joomla exposes content and configuration mutations through both the administrative backend UI and a RESTful webservice API. The backend UI enforces ACL checks that prevent restricted users from executing certain create, update, or delete operations. The webservice endpoints handling identical mutations do not apply the same ACL logic consistently.
An authenticated user restricted from performing an action in the backend can send equivalent mutation requests to the webservice API and succeed. This creates an authorization bypass affecting confidentiality and integrity of Joomla-managed data.
Root Cause
The root cause is duplicated authorization logic across two interfaces without a shared enforcement point. Backend controllers apply ACL rules through one code path, while webservice controllers process mutation requests through a separate path that omits or incorrectly evaluates the equivalent checks. Any divergence between these paths yields inconsistent policy enforcement.
Attack Vector
An attacker requires valid authenticated credentials with backend access, indicated by the high privileges-required rating in the CVSS vector. The attacker crafts HTTP requests targeting Joomla webservice endpoints that correspond to actions restricted in the UI. Since the network is the attack surface and no user interaction is required, exploitation is straightforward once credentials are obtained. Refer to the Joomla Security Advisory for technical details.
Detection Methods for CVE-2026-71574
Indicators of Compromise
- Unexpected POST, PUT, PATCH, or DELETE requests to /api/index.php/v1/ endpoints from lower-privileged accounts
- Content, extension, or configuration changes appearing without corresponding backend UI audit trail entries
- Webservice API traffic originating from user accounts that lack UI permissions for equivalent actions
Detection Strategies
- Correlate webservice API activity against user role and ACL assignments to identify privilege discrepancies
- Monitor for mutation requests from accounts that historically only performed read operations
- Enable and review Joomla action logging for changes attributed to unexpected user identities
Monitoring Recommendations
- Log all authenticated requests to Joomla /api/ routes with the requesting user, HTTP method, and target resource
- Alert on repeated authorization anomalies where webservice mutations succeed for users restricted in the UI
- Baseline normal webservice API usage per role to surface deviations quickly
How to Mitigate CVE-2026-71574
Immediate Actions Required
- Upgrade Joomla to a patched version above 5.4.7 in the 5.x branch or above 6.1.2 in the 6.x branch
- Audit backend user accounts and remove or downgrade privileges for accounts that do not require them
- Review action logs and webservice access logs for unauthorized mutations since exposure
Patch Information
Joomla has published a fix as described in the Joomla Security Advisory 20260803. Administrators should apply the update through the standard Joomla update system or via the Joomla downloads page.
Workarounds
- Disable the Joomla webservice API if it is not required by restricting /api/ routes at the web server or reverse proxy layer
- Restrict webservice API access to trusted IP ranges through firewall or web server rules until the patch is applied
- Require API tokens tied to accounts with the least privilege necessary and rotate credentials for accounts with broad backend access
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
