CVE-2026-73371 Overview
CVE-2026-73371 is an improper access control vulnerability in Joomla! Core affecting versions 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2. The flaw resides in the Access Control List (ACL) checks for batch copy actions. Authenticated users can perform copy batch operations on items they are not authorized to edit. The issue is tracked under [CWE-284: Improper Access Control] and carries a CVSS v4.0 score of 5.1.
Critical Impact
Authenticated users with limited privileges can bypass ACL enforcement to copy content items they should not be able to modify, undermining content integrity in Joomla-managed sites.
Affected Products
- Joomla! Core versions 4.0.0 through 5.4.7
- Joomla! Core versions 6.0.0 through 6.1.2
- Joomla content management deployments using batch operations
Discovery Timeline
- 2026-08-18 - CVE-2026-73371 published to the National Vulnerability Database
- 2026-08-18 - Last updated in NVD database
Technical Details for CVE-2026-73371
Vulnerability Analysis
The vulnerability affects the batch copy functionality in Joomla! Core. Batch operations allow administrators and editors to apply actions such as copy, move, or reassign against multiple items at once. Joomla enforces ACL rules to ensure users can only manipulate items they are permitted to edit.
The batch copy action does not correctly validate whether the invoking user holds edit permissions on the source items. As a result, an authenticated user with lower privileges can duplicate items that the ACL would otherwise block. The vendor advisory classifies the defect under improper access control, consistent with [CWE-284].
Root Cause
The root cause is a missing or incomplete permission check in the batch copy handler. The code path executes the copy without verifying that the current user satisfies the core.edit requirement for the selected items. Authorization logic present in single-item workflows is not consistently applied to batch operations.
Attack Vector
Exploitation requires network access to a Joomla site and authenticated credentials with at least limited backend access. An attacker submits a batch copy request targeting items outside their ACL scope. The application processes the request and creates copies without rejecting the operation. See the Joomla Security Advisory for vendor-published technical details.
Detection Methods for CVE-2026-73371
Indicators of Compromise
- Unexpected duplicate content items appearing in categories or sections managed by higher-privileged users
- Administrator log entries showing batch copy actions initiated by accounts without corresponding edit rights
- Activity from backend user accounts that normally do not perform content management tasks
Detection Strategies
- Audit the Joomla action logs (com_actionlogs) for com_content batch operations grouped by user ID and target item ownership
- Correlate web server access logs for POST requests to backend batch endpoints with the authenticated user's ACL role
- Compare pre- and post-change content inventories to identify unauthorized duplicates
Monitoring Recommendations
- Enable Joomla's User Actions Log plugin and forward events to a centralized logging platform
- Alert on batch copy operations executed by non-administrator accounts
- Review privilege assignments in User Groups and ACL rules on a recurring cadence
How to Mitigate CVE-2026-73371
Immediate Actions Required
- Upgrade Joomla! Core to a fixed release beyond 5.4.7 in the 5.x branch or beyond 6.1.2 in the 6.x branch
- Inventory all backend user accounts and revoke unnecessary edit or manager privileges
- Review recent batch copy activity for signs of ACL bypass abuse
Patch Information
Joomla has issued fixed releases addressing the improper ACL check in batch copy actions. Administrators should apply the patched versions per the Joomla Security Advisory. Refer to the Joomla official site for release downloads and upgrade instructions.
Workarounds
- Restrict backend access to trusted IP ranges via web server or WAF rules until patches are applied
- Temporarily disable or restrict backend accounts that do not require batch operation privileges
- Monitor and manually review batch copy activity where an immediate upgrade is not feasible
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
