CVE-2026-76596: Joomla Fabrik Auth Bypass Vulnerability

CVE-2026-76596 Overview

CVE-2026-76596 is a broken access control vulnerability in the Fabrik extension for Joomla, published by fabrikar.com. The doempty endpoint in the list controller lacks Access Control List (ACL) gates. An unauthenticated attacker can send a plain HTTP GET request to empty the target list's underlying database table. The flaw affects Fabrik versions prior to 4.7.2 and is categorized under [CWE-284] Improper Access Control.

Critical Impact
Unauthenticated attackers can truncate arbitrary Fabrik list tables over the network with a single GET request, resulting in destructive data loss without authentication or user interaction.

Affected Products

Fabrik extension for Joomla, versions prior to 4.7.2
Vendor: fabrikar.com
Component: Fabrik list controller doempty endpoint

Discovery Timeline

2026-08-22 - CVE-2026-76596 published to the National Vulnerability Database (NVD)
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-76596

Vulnerability Analysis

The Fabrik extension exposes a doempty action on the list controller through Joomla's front-end component routing. This action is designed to empty the records stored in a Fabrik list's backing database table. The endpoint does not verify the requester's session, role, or component permissions before executing the truncation operation.

An attacker only needs to know or enumerate the target listid parameter. Fabrik list identifiers are typically sequential integers and are often exposed in public Joomla pages that render Fabrik lists or forms. Because the endpoint responds to GET requests, the attack can be delivered through a browser, a crawler, a cached link, or a cross-origin request.

The impact is limited to data integrity. Confidentiality and availability are not directly affected at the platform level, but the loss of application data can produce cascading availability issues for dependent workflows.

Root Cause

The root cause is a missing authorization check in the list.doempty controller action. Fabrik's other destructive actions gate execution on component ACL rules and cross-site request forgery tokens, but the doempty handler was not wrapped in the same permission wrapper. This is a classic [CWE-284] Improper Access Control defect where a sensitive state-changing operation is reachable by anonymous users.

Attack Vector

The vulnerability is exploitable remotely over the network without authentication or user interaction. An attacker issues an HTTP GET request to the Joomla index.php entry point specifying option=com_fabrik, task=list.doempty, and a valid listid. The server executes the truncation against the mapped database table and returns a standard Fabrik response. No credentials, cookies, or referer headers are required. Because the action uses GET, drive-by exploitation through embedded images or links is feasible against administrators who visit an attacker-controlled page while authenticated to unrelated sites.

Detection Methods for CVE-2026-76596

Indicators of Compromise

HTTP access log entries containing option=com_fabrik combined with task=list.doempty or view=list&layout=doempty, especially from unauthenticated sessions.
Sudden drop of row counts to zero in one or more Fabrik-managed database tables without a corresponding administrative action in Joomla audit logs.
Requests to com_fabrik endpoints originating from IP addresses that have no prior authenticated session with the Joomla site.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule that blocks or alerts on unauthenticated requests matching the list.doempty task parameter for com_fabrik.
Correlate database TRUNCATE or bulk DELETE events against the Fabrik-managed schemas with concurrent HTTP requests to the Joomla front controller.
Alert on any 200-status response to index.php requests where the query string contains both com_fabrik and doempty.

Monitoring Recommendations

Forward Joomla access logs and MySQL general or audit logs into a centralized analytics platform for cross-source correlation.
Baseline expected row counts for Fabrik lists and alert on abrupt decreases outside scheduled maintenance windows.
Monitor egress requests referencing Fabrik task parameters from crawlers, scanners, and unexpected geographies.

How to Mitigate CVE-2026-76596

Immediate Actions Required

Upgrade the Fabrik extension to version 4.7.2 or later on all Joomla instances.
Take database backups of every Fabrik-managed table before applying updates so that any recent truncation can be restored.
Audit HTTP access logs for prior requests to list.doempty and identify whether any list tables have already been emptied.

Patch Information

The vendor fixed the issue in Fabrik 4.7.2. Verify integrity of the installed component through the Joomla Extensions Manager and confirm the version string after the update. Vendor information and download links are available on the Fabrikar Official Website.

Workarounds

If immediate patching is not feasible, block requests containing task=list.doempty or layout=doempty for com_fabrik at the WAF or reverse proxy layer.
Restrict access to com_fabrik endpoints to authenticated administrator sessions using web server access rules.
Temporarily disable the Fabrik component in Joomla until the update to 4.7.2 is applied.

bash

# Example nginx rule to block the vulnerable endpoint until patched
if ($args ~* "option=com_fabrik.*task=list\.doempty") {
    return 403;
}
if ($args ~* "option=com_fabrik.*layout=doempty") {
    return 403;
}