CVE-2026-76599: Joomla Fabrik Information Disclosure Flaw

CVE-2026-76599 Overview

CVE-2026-76599 is an information disclosure vulnerability in the Fabrik extension for Joomla, developed by fabrikar.com. Versions of Fabrik prior to 4.7.2 expose an unauthenticated ajax_tables method in the elements model. The method returns listings of arbitrary database tables, including column details and the configured table prefix. Attackers can query this endpoint over the network without credentials or user interaction. The exposed metadata assists reconnaissance for follow-on attacks such as SQL injection or targeted data extraction. The vulnerability is tracked under [CWE-284: Improper Access Control].

Critical Impact
Unauthenticated remote attackers can enumerate database tables, columns, and prefixes on affected Joomla installations running Fabrik < 4.7.2.

Affected Products

Fabrik Joomla extension versions prior to 4.7.2
Joomla installations with Fabrik enabled and reachable over HTTP(S)
fabrikar.com Fabrik component deployments

Discovery Timeline

2026-08-22 - CVE-2026-76599 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-76599

Vulnerability Analysis

The Fabrik extension exposes an AJAX endpoint that maps to the ajax_tables method inside the elements model. The method executes database introspection routines and returns the resulting metadata to the caller. Access control checks are absent, so any anonymous HTTP client can invoke the endpoint. The response includes table names, column definitions, and the site's configured database table prefix.

Disclosed schema information reduces attacker uncertainty during reconnaissance. Adversaries can map custom tables, identify sensitive column names, and craft precise payloads for injection or scraping campaigns. The disclosure also weakens defenses that rely on randomized or non-default table prefixes for obscurity.

Root Cause

The root cause is improper access control on the ajax_tables handler. The method performs privileged database introspection without verifying the caller's authentication state, session, or Joomla capability tokens. Fabrik 4.7.2 addresses the issue by restricting access to the endpoint.

Attack Vector

Exploitation requires only network access to the Joomla site. An attacker issues an HTTP request to the Fabrik AJAX entry point that dispatches to the ajax_tables method. No credentials, session cookies, or user interaction are required. Successful requests return JSON-formatted table and column listings. See the Fabrikar Official Website for product context.

No verified public proof-of-concept is available. The vulnerability mechanism is described in prose because no realCodeExamples were supplied.

Detection Methods for CVE-2026-76599

Indicators of Compromise

HTTP requests to Fabrik AJAX endpoints containing the parameter task=ajax_tables or view=element with table enumeration arguments
Anonymous requests returning large JSON payloads that include database table and column names
Repeated access to Fabrik component URLs from a single source IP within a short window

Detection Strategies

Inspect web server access logs for unauthenticated requests targeting index.php with Fabrik component parameters and the ajax_tables task
Deploy WAF rules that flag responses containing SQL schema keywords such as TABLE_NAME or column-listing structures from Fabrik URIs
Correlate reconnaissance traffic against Fabrik with subsequent SQL injection probe patterns in the same session

Monitoring Recommendations

Enable verbose logging on the Joomla web tier and forward logs to a central analytics platform for query-based hunting
Alert on HTTP 200 responses to Fabrik AJAX endpoints from IP addresses without prior authenticated sessions
Track outbound response sizes from Fabrik endpoints; sudden growth may indicate schema enumeration

How to Mitigate CVE-2026-76599

Immediate Actions Required

Upgrade Fabrik to version 4.7.2 or later on all Joomla sites where the component is installed
Audit web logs for prior invocations of the ajax_tables method and assess exposure of sensitive schema
Restrict access to the Fabrik component from untrusted networks until the patch is applied

Patch Information

Fabrik 4.7.2 remediates the unauthenticated schema disclosure by enforcing access control on the ajax_tables handler. Administrators should obtain the fixed release from the Fabrikar Official Website and apply it through the Joomla extension manager. Verify the installed version after upgrade to confirm remediation.

Workarounds

Disable or unpublish the Fabrik component temporarily if immediate patching is not possible
Add a WAF or reverse-proxy rule that blocks requests containing task=ajax_tables targeting Fabrik URIs
Restrict access to /index.php?option=com_fabrik paths by source IP where feasible

bash

# Example nginx rule blocking the vulnerable endpoint until patched
location ~* /index\.php {
    if ($args ~* "option=com_fabrik.*task=ajax_tables") {
        return 403;
    }
}