CVE-2026-73372: Joomla! Core Auth Bypass Vulnerability

CVE-2026-73372 Overview

CVE-2026-73372 is an improper access control vulnerability in Joomla! Core affecting versions 5.1.0 through 5.4.7 and 6.0.0 through 6.1.2. The flaw resides in the routine that injects contact information into schema.org structured data snippets. Joomla fails to enforce Access Control List (ACL) checks before adding contact records to page metadata. As a result, contact data belonging to items that a viewer should not access can be exposed in schema.org markup rendered on public pages. The issue is tracked under Joomla advisory 20260809 and mapped to [CWE-284: Improper Access Control].

Critical Impact
Contact records restricted by ACL can leak into schema.org snippets, exposing internal or non-public contact details to unauthorized parties over the network.

Affected Products

Joomla! Core versions 5.1.0 through 5.4.7
Joomla! Core versions 6.0.0 through 6.1.2
Joomla sites using the com_contact component with schema.org output enabled

Discovery Timeline

2026-08-18 - CVE-2026-73372 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-73372

Vulnerability Analysis

The vulnerability sits in Joomla's schema.org contact data injection logic within the com_contact component. Joomla generates JSON-LD or microdata snippets that describe contact entities to search engines and consumers of structured data. The generator queries contact records and embeds their fields into the rendered snippet without confirming that the current viewer holds the required view permission for each record.

Because the check is missing, contact records that administrators restrict through ACL still appear in the injected schema. Attackers with low-privileged authenticated access, or in some configurations any network visitor viewing pages that render the snippet, can read the leaked contact attributes. The exposure is limited to confidentiality of contact fields. Integrity and availability of the Joomla application remain unaffected, and the flaw does not enable code execution.

Root Cause

The root cause is missing authorization enforcement between the data retrieval step and the schema.org rendering step. The component treats schema output as a public metadata surface and applies ACL only to primary content rendering paths. This gap represents a classic [CWE-284] failure where an alternative data egress path bypasses the intended access model.

Attack Vector

Exploitation requires network access to a vulnerable Joomla site and a page that triggers schema.org contact injection. An attacker inspects the page source or crawls JSON-LD blocks to extract contact fields for records they should not be able to view. High privileges are required per the CVSS metrics, indicating the trigger context typically involves an authenticated backend or restricted view rather than a fully anonymous request. No user interaction is needed. See the Joomla Security Advisory: ACL Checks for the vendor description.

Detection Methods for CVE-2026-73372

Indicators of Compromise

Presence of contact fields inside <script type="application/ld+json"> blocks on pages where the viewer lacks ACL permission for those contacts
Anomalous HTTP GET requests to com_contact routes from low-privileged sessions returning schema.org payloads with restricted data
Crawler or scraper user agents repeatedly retrieving pages that render contact schema markup

Detection Strategies

Audit rendered pages by requesting them as an unauthenticated or low-privileged user and diffing the JSON-LD output against the ACL matrix for com_contact
Correlate web server access logs with Joomla contact IDs referenced in schema payloads to identify records exposed to unauthorized principals
Search application logs for schema generation calls that do not precede an ACL evaluation on the returned contact set

Monitoring Recommendations

Alert on outbound response bodies containing structured contact fields tied to contact records flagged as internal or private
Track version banners across the Joomla estate to identify hosts running 5.1.0-5.4.7 or 6.0.0-6.1.2 prior to patching
Monitor for automated scraping patterns against contact category URLs following disclosure of CVE-2026-73372

How to Mitigate CVE-2026-73372

Immediate Actions Required

Upgrade Joomla to a fixed release beyond 5.4.7 in the 5.x branch or beyond 6.1.2 in the 6.x branch
Inventory contact records marked as restricted and confirm none have been indexed by external search engines from cached schema output
Review web server and CDN caches, purging any cached pages that may contain leaked JSON-LD contact data

Patch Information

Joomla addressed the improper access control in the corresponding maintenance releases documented in the Joomla Security Advisory: ACL Checks. Apply the update through the standard Joomla Update component or via the full package download from the Joomla Official Website. Verify the installed version reads higher than 5.4.7 or 6.1.2 after upgrade.

Workarounds

Disable schema.org contact injection in the com_contact component configuration until patching is complete
Restrict access to contact category pages at the web server or reverse proxy layer for anonymous and low-privileged users
Remove or unpublish sensitive contact records from Joomla until the fixed version is deployed

bash

# Verify installed Joomla core version from the CLI
php cli/joomla.php core:check-updates

# Or inspect the version file directly
grep -E "RELEASE|DEV_LEVEL" libraries/src/Version.php