CVE-2026-78374 Overview
CVE-2026-78374 affects the JoomlArt T4 Page Builder extension for Joomla in versions prior to 2.3.0. The extension exposes a front-end JSON editor endpoint that implements a contact action without authentication, CSRF protection, captcha enforcement, or rate limiting. Attackers fully control the recipient address, subject line, and HTML body of outbound mail. Messages are sent using the site's configured sender identity (mailfrom and fromname), turning vulnerable Joomla sites into open mail relays. The flaw is categorized under CWE-201 and impacts confidentiality and availability of the mail subsystem.
Critical Impact
Unauthenticated attackers can abuse vulnerable Joomla sites to send arbitrary emails from the site's identity, enabling phishing, spam distribution, and domain reputation damage.
Affected Products
- JoomlArt T4 Page Builder extension for Joomla, versions prior to 2.3.0
- Joomla sites with T4 Page Builder installed and the front-end JSON editor endpoint reachable
- Deployments without a captcha plugin configured for the contact action
Discovery Timeline
- 2026-09-10 - CVE-2026-78374 published to the National Vulnerability Database
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-78374
Vulnerability Analysis
The T4 Page Builder extension registers a front-end JSON editor endpoint that dispatches actions based on request parameters. One of these actions, contact, invokes the Joomla mail subsystem to send an email to a caller-supplied recipient. The endpoint performs no session validation, so an anonymous HTTP client can call it directly. No CSRF token is required, meaning cross-origin abuse is also possible when a victim visits an attacker page.
Because the recipient, subject, and HTML body parameters are all attacker controlled, the request functions as an unauthenticated mail submission API. Outbound messages carry the site's configured mailfrom address and fromname display name, giving spam and phishing content legitimate provenance from the target domain. Neither captcha challenges nor rate limiting are applied when no captcha plugin is enabled, allowing high-volume abuse from a single attacker.
Root Cause
The root cause is missing access control combined with absent anti-automation defenses on the contact action. The endpoint treats an unauthenticated front-end call as a trusted mail submission and reflects fully controlled fields into an outbound message without validation or throttling.
Attack Vector
Exploitation requires only network access to the vulnerable Joomla site. An attacker sends an HTTP POST request to the JSON editor endpoint with the contact action, supplying arbitrary values for the recipient, subject, and HTML body. The Joomla mail subsystem then delivers the message using the site's sender identity. The attack does not require user interaction, credentials, or elevated privileges. See the JoomlArt T4 Joomla Page Builder product page for extension details.
Detection Methods for CVE-2026-78374
Indicators of Compromise
- Unauthenticated POST requests to the T4 Page Builder JSON editor endpoint referencing the contact action
- Outbound SMTP traffic from the site with mailfrom/fromname matching the Joomla configuration but recipients outside the normal user base
- Bounce messages, spam complaints, or blocklist notifications targeting the site's sender domain
- Sudden spikes in mail queue depth or SMTP relay volume from the Joomla web server
Detection Strategies
- Inspect web server access logs for repeated POST requests to the T4 Page Builder editor endpoint invoking action=contact from single source IPs
- Correlate web request patterns with mail transfer agent logs to identify messages generated by anonymous requests
- Alert on outbound mail with high recipient diversity originating from the web application user
Monitoring Recommendations
- Monitor SMTP submission logs for volume anomalies and recipient domains outside expected business communications
- Track sender domain reputation and blocklist status across major providers to catch abuse early
- Enable Joomla request logging for front-end AJAX endpoints exposed by installed extensions
How to Mitigate CVE-2026-78374
Immediate Actions Required
- Upgrade the JoomlArt T4 Page Builder extension to version 2.3.0 or later on all Joomla sites
- Enable a captcha plugin on the Joomla instance so the contact action enforces the challenge
- Review recent mail logs for evidence of relay abuse and notify affected recipients if spam or phishing was sent
Patch Information
The vendor addressed the vulnerability in T4 Page Builder 2.3.0. Site administrators should install this release or a later version through the Joomla extension manager. Refer to the JoomlArt T4 Joomla Page Builder product page for the current download and update instructions.
Workarounds
- Restrict access to the T4 Page Builder JSON editor endpoint at the web server or WAF layer until the patch is applied
- Enforce rate limiting on front-end AJAX endpoints to blunt high-volume relay attempts
- Temporarily disable the T4 Page Builder extension on sites where an immediate upgrade is not feasible
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
