Developer Network™ There is always a great deal of Joomla! development activity underway and communicating with other developers in the community is essential. This site is a resource for anyone looking to build or maintain software based on the Joomla! platform.
Where to Start
- Project: Joomla!
- SubProject: CMS
- Impact: Low
- Severity: Low
- Probability: Moderate
- Versions: 3.0.0-5.4.3, 6.0.0-6.0.3
- Exploit type: Incorrect Access Control
- Reported Date: 2026-03-11
- Fixed Date: 2026-03-31
- CVE Number: CVE-2026-21629
Description
The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party developers.
Affected Installs
Joomla! CMS versions 3.0.0-5.4.3, 6.0.0-6.0.3
Solution
Upgrade to version 5.4.4 or 6.0.4
Contact
The JSST at the Joomla! Security Centre.
Reported By: JSST
- Project: Joomla!
- SubProject: CMS
- Impact: High
- Severity: Low
- Probability: Moderate
- Versions: 4.0.0-5.4.3, 6.0.0-6.0.3
- Exploit type: SQLi
- Reported Date: 2026-03-05
- Fixed Date: 2026-03-31
- CVE Number: CVE-2026-21630
Description
Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint.
Affected Installs
Joomla! CMS versions 4.0.0-5.4.3, 6.0.0-6.0.3
Solution
Upgrade to version 5.4.4 or 6.0.4
Contact
The JSST at the Joomla! Security Centre.
Reported By: Antonio Morales from GitHub Security Lab Taskflow Agent / vnth4nhnt from CyStack
- Project: Joomla!
- SubProject: CMS
- Impact: Moderate
- Severity: Moderate
- Probability: Low
- Versions: 4.0.0-5.4.3, 6.0.0-6.0.3
- Exploit type: XSS
- Reported Date: 2026-03-11
- Fixed Date: 2026-03-31
- CVE Number: CVE-2026-21631
Description
Lack of output escaping leads to a XSS vector in the multilingual associations component
Affected Installs
Joomla! CMS versions 4.0.0-5.4.3, 6.0.0-6.0.3
Solution
Upgrade to version 5.4.4 or 6.0.4
Contact
The JSST at the Joomla! Security Centre.
Reported By: Shirsendu Mondal & Md Tanzimul Alam Fahim, UNC Pembroke