CVE-2026-90916: Joomla! Core Authorization Bypass Vulnerability

CVE-2026-90916 Overview

CVE-2026-90916 is an improper access control vulnerability in Joomla! Core affecting the content history comparison view. The flaw exists in Joomla versions 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3. Insufficient Access Control List (ACL) validation allows authenticated users to view content they are not authorized to access. The issue is tracked under CWE-284: Improper Access Control.

Critical Impact

Authenticated users with high privileges can bypass ACL checks in the content history comparison view to disclose otherwise inaccessible content stored within Joomla-managed sites.

Affected Products

• Joomla! Core 4.0.0 through 5.4.8
• Joomla! Core 6.0.0 through 6.1.3
• Joomla installations exposing the content history comparison view to authenticated backend users

Discovery Timeline

• 2026-09-29 - CVE-2026-90916 published to the National Vulnerability Database
• 2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-90916

Vulnerability Analysis

The vulnerability resides in Joomla's content history comparison feature. This feature lets editors compare revisions of managed content items. The comparison view fails to enforce ACL checks that would normally restrict access based on the requesting user's permissions. As a result, an authenticated user can request a comparison for content items they should not see and receive the underlying content in the response.

Because the check occurs at the view layer instead of at the data-retrieval layer, ACL enforcement is bypassed once the user reaches the comparison workflow. The confidentiality impact is limited to content visible through the history subsystem, and no integrity or availability impact is reported. Additional context is available in the Joomla Security Advisory: Improper ACL Checks.

Root Cause

The root cause is missing or incomplete ACL verification within the content history comparison controller and view. The affected code path assumes the calling user already passed an authorization gate. It therefore returns historical content revisions without re-validating that the current user retains view permissions on the referenced item.

Attack Vector

Exploitation requires network access to the Joomla backend and an authenticated account with high privileges, per the CVSS vector. User interaction is not required. The attacker invokes the content history comparison endpoint and supplies identifiers for content records outside their assigned ACL scope. The server returns the revision data without rejecting the request.

The vulnerability manifests in the comparison view logic rather than in a discrete function that lends itself to a short code sample. See the vendor advisory linked above for the specific commit references.

Detection Methods for CVE-2026-90916

Indicators of Compromise

• Backend HTTP requests to the com_contenthistory component from user accounts that do not own or have delegated rights to the referenced content items
• Unexpected task=compare.compare or comparison view invocations in Joomla access logs
• Access patterns where a single authenticated account requests history for many content IDs across categories the user does not normally edit

Detection Strategies

• Review Joomla access and audit logs for requests to the content history comparison view and correlate the referenced content IDs against each user's assigned ACL groups
• Enable web server request logging with query strings so com_contenthistory parameters are captured for later analysis
• Deploy web application firewall rules that alert on comparison requests originating from accounts outside the editorial team

Monitoring Recommendations

• Forward Joomla and web server logs to a centralized analytics platform and build dashboards tracking access to com_contenthistory endpoints
• Alert on any anonymous or low-privilege account attempting to reach the content history comparison view
• Baseline normal editorial behavior and flag deviations such as bulk revision access outside business hours

How to Mitigate CVE-2026-90916

Immediate Actions Required

• Upgrade Joomla! Core to the fixed release listed in the Joomla Security Advisory
• Audit backend user accounts and remove standing high-privilege access that is not required for daily operations
• Review recent content history comparison activity to determine whether unauthorized access occurred prior to patching

Patch Information

Joomla has published a security advisory addressing the improper ACL check in the content history comparison view. Administrators should update to the patched versions above the affected ranges (post-5.4.8 in the 5.x branch and post-6.1.3 in the 6.x branch). Full details, including the fixed version numbers and upgrade instructions, are provided at the Joomla Security Centre and the Joomla Official Website.

Workarounds

• Restrict access to the Joomla administrator interface using IP allowlisting or VPN-only reachability until patches are applied
• Temporarily disable the content history component for user groups that do not require revision comparison functionality
• Reduce the number of users assigned to Super User, Administrator, and Manager groups to limit the pool of accounts able to reach the vulnerable view

# Configuration example: restrict administrator access via .htaccess
<Files ~ "^administrator">
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</Files>