CVE-2026-90907: Joomla! Core Auth Bypass Vulnerability

CVE-2026-90907 Overview

CVE-2026-90907 is an authorization flaw in the Joomla! Core profile.save controller. The controller fails to verify the login state of the requesting user before executing account creation logic. Unauthenticated attackers can create guest-level user accounts on Joomla sites even when public user registration is disabled. The issue affects Joomla versions 1.5.0 through 5.4.8 and 6.0.0 through 6.1.3. The vulnerability is tracked under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Remote unauthenticated attackers can create guest-level user accounts on Joomla sites that have registration explicitly disabled, undermining site access policy and enabling downstream abuse.

Affected Products

Joomla! Core versions 1.5.0 through 5.4.8
Joomla! Core versions 6.0.0 through 6.1.3
Joomla sites with public user registration disabled (still exploitable)

Discovery Timeline

2026-09-29 - CVE-2026-90907 published to the National Vulnerability Database
2026-09-29 - Last updated in NVD database
Additional details available in the Joomla Security Advisory #1082

Technical Details for CVE-2026-90907

Vulnerability Analysis

The vulnerability resides in the profile.save controller within Joomla! Core. This controller is intended to allow authenticated users to update their profile data. It does not verify that the caller holds an authenticated session before invoking downstream account persistence logic. When a request reaches the controller without a valid session, the framework proceeds to persist the submitted profile fields as a new guest-level user record. Administrators who intentionally disable user registration still expose this code path because the check occurs at the registration workflow, not inside profile.save. The result is unauthorized account creation on sites configured to reject new users.

Root Cause

The root cause is a missing authorization check in the profile.save controller. The controller trusts that route-level or session-level checks have already enforced authentication, but no such check occurs on this path. This matches the pattern described by [CWE-639], where a resource action is reachable without validating that the caller is authorized to invoke it. The registration-disabled setting is enforced only inside the standard registration controller, not across every code path that can create a user record.

Attack Vector

Exploitation requires only network access to the target Joomla site. An attacker sends an unauthenticated HTTP POST request to the profile.save endpoint with attacker-controlled profile fields. The controller processes the request without a session check and creates a guest-level user account. No user interaction or prior credentials are required. Refer to the Joomla Security Advisory #1082 for the vendor's technical description. No public proof-of-concept code is available at the time of publication.

Detection Methods for CVE-2026-90907

Indicators of Compromise

Unexpected new user accounts in the Joomla #__users table on sites where registration is disabled
Guest-level accounts created outside normal administrative workflows or approved provisioning
HTTP POST requests targeting the profile.save controller from unauthenticated sessions
User accounts created from source IP addresses that do not correspond to legitimate site administrators

Detection Strategies

Correlate web server access logs for POST requests to Joomla profile routes with no preceding authenticated session cookie
Alert on any increase in Joomla user creation events on sites configured with registration disabled
Baseline expected administrator IPs and flag account creation from any other source

Monitoring Recommendations

Enable Joomla action logging for user lifecycle events and forward to a central log platform
Monitor the #__users table for row additions and reconcile them against approved workflows daily
Track HTTP 200 responses to profile.save requests originating from anonymous sessions

How to Mitigate CVE-2026-90907

Immediate Actions Required

Upgrade Joomla! Core to a fixed release above 5.4.8 or 6.1.3 as published by the Joomla project
Audit the #__users table for accounts created since the vulnerable code was deployed and remove unauthorized entries
Reset credentials and invalidate active sessions for any accounts of uncertain origin
Review site content and configuration for changes made by unauthorized guest accounts

Patch Information

The Joomla project has released fixed versions addressing the missing authorization check in the profile.save controller. Apply the upgrade documented in the Joomla Security Advisory #1082. Administrators running long-lived releases in the 1.5.x through 5.4.x branches should plan migration to a supported, patched line.

Workarounds

Restrict access to the Joomla profile.save route at the web server or WAF layer to authenticated sessions only
Deploy WAF rules that block POST requests to profile endpoints without a valid authentication cookie
Temporarily disable public access to profile controllers if patching is delayed

bash

# Example nginx rule to block unauthenticated POSTs to the profile save endpoint
location ~ /index\.php {
    if ($request_method = POST) {
        set $block "A";
    }
    if ($args ~* "task=profile\.save") {
        set $block "${block}B";
    }
    if ($http_cookie !~* "joomla_user_state") {
        set $block "${block}C";
    }
    if ($block = "ABC") {
        return 403;
    }
}