Developer Network™
Download
Launch

Security Announcements

This feed provides announcements of resolved security issues in Joomla! software releases.

For more information about the Joomla! Security Strike Team (JSST) and its processes, please review our Security article.

To report potential security issues, please follow the guidelines in the above referenced article. Please note that we are only able to provide support for the Joomla! CMS, Joomla! Framework, and *.joomla.org network of websites.

You can subscribe to notifications from this feed through a RSS reader.

[20260702] - Core - Incorrect Access Control in com_contact vcf download

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Probability: Low
  • Versions: 3.0.0-5.4.6,6.0.0-6.1.1
  • Exploit type: Incorrect Access Control
  • Reported Date: 2026-05-07
  • Fixed Date: 2026-07-07
  • CVE Number: CVE-2026-48948

Description

An improper access check allows user to download vcard exports of com_contact contacts that are inaccessible.

Affected Installs

Joomla! CMS versions 3.0.0-5.4.5,6.0.0-6.1.1

Solution

Upgrade to version 5.4.7, 6.1.2

Contact

The JSST at the Joomla! Security Centre.

Reported By:  Jorian Woltjer

[20260701] - Core - Incorrect Access Control in com_media webservice endpoints

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Low
  • Probability: Low
  • Versions: 4.1.0-5.4.6,6.0.0-6.1.1
  • Exploit type: Incorrect Access Control
  • Reported Date: 2026-05-05
  • Fixed Date: 2026-07-07
  • CVE Number: CVE-2026-48947

Description

An improper access check allows privileged users to overwrite media files without editing permissions.

Affected Installs

Joomla! CMS versions 4.1.0-5.4.6,6.0.0-6.1.1

Solution

Upgrade to version 5.4.7, 6.1.2

Contact

The JSST at the Joomla! Security Centre.

Reported By:  Federico Brasili

[20260520] - Framework - Inadequate content filtering within the cleanAttributes filter code

  • Project: Joomla!
  • SubProject: Framewok
  • Impact: Moderate
  • Severity: Moderate
  • Probability: Moderate
  • Versions: 3.0.0-5.4.5,6.0.0-6.1.0
  • Exploit type: XSS
  • Reported Date: 2026-05-04
  • Fixed Date: 2026-05-26
  • CVE Number: CVE-2026-48905

Description

Lack of input filtering leads to an XSS vector in the HTML filter code.

Affected Installs

Joomla! CMS versions 3.0.0-5.4.5,6.0.0-6.1.0

Solution

Upgrade to version 5.4.6,6.1.1

Contact

The JSST at the Joomla! Security Centre.

Reported By:  Jesper den Boer

[20260519] - Framework - Inadequate content filtering within the checkAttribute filter code

  • Project: Joomla!
  • SubProject: Framewok
  • Impact: Moderate
  • Severity: Moderate
  • Probability: Moderate
  • Versions: 3.0.0-5.4.5,6.0.0-6.1.0
  • Exploit type: XSS
  • Reported Date: 2026-04-21
  • Fixed Date: 2026-05-26
  • CVE Number: CVE-2026-48903

Description

Inadequate content filtering within the checkAttribute methods leads to XSS vulnerabilities in various components.

Affected Installs

Joomla! CMS versions 3.0.0-5.4.5,6.0.0-6.1.0

Solution

Upgrade to version 5.4.6,6.1.1

Contact

The JSST at the Joomla! Security Centre.

Reported By:  JSST

[20260518] - Core - Transport encryption downgrade for password and username reset links

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Probability: Low
  • Versions: 3.9.0-5.4.5,6.0.0-6.1.0
  • Exploit type: Mixed Content
  • Reported Date: 2026-04-20
  • Fixed Date: 2026-05-26
  • CVE Number: CVE-2026-48902

Description

The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set.

Affected Installs

Joomla! CMS versions 3.9.0-5.4.5,6.0.0-6.1.0

Solution

Upgrade to version 5.4.6,6.1.1

Contact

The JSST at the Joomla! Security Centre.

Reported By:  ZeroXJacks, Github

[20260517] - Core - Incorrect Cache Key Construction for InputFilter objects

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Probability: Low
  • Versions: 4.0.0-5.4.5,6.0.0-6.1.0
  • Exploit type: Incorrect Cache Key Construction
  • Reported Date: 2025-11-14
  • Fixed Date: 2026-05-26
  • CVE Number: CVE-2026-48901

Description

The InputFilter::getInstance() method omitted a security sensitive parameter from the instance cache key.

Affected Installs

Joomla! CMS versions 4.0.0-5.4.5,6.0.0-6.1.0

Solution

Upgrade to version 5.4.6,6.1.1

Contact

The JSST at the Joomla! Security Centre.

Reported By:  ZeroXJacks, Github

[20260516] - Core - Incorrect Access Control in com_scheduler

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Low
  • Probability: Low
  • Versions: 4.1.0-5.4.5,6.0.0-6.1.0
  • Exploit type: Incorrect Access Control
  • Reported Date: 2026-04-29
  • Fixed Date: 2026-05-26
  • CVE Number: CVE-2026-48900

Description

An improper access check allowed low privileged users to edit the task types of existing scheduler tasks.

Affected Installs

Joomla! CMS versions 4.1.0-5.4.5,6.0.0-6.1.0

Solution

Upgrade to version 5.4.6,6.1.1

Contact

The JSST at the Joomla! Security Centre.

Reported By:  Federico Brasili, Linkedin

[20260515] - Core - Incorrect Access Control in sample data plugins

  • Project: Joomla!
  • SubProject: CMS
  • Impact: High
  • Severity: Moderate
  • Probability: Moderate
  • Versions: 4.0.0-5.4.5,6.0.0-6.1.0
  • Exploit type: Incorrect Access Control
  • Reported Date: 2026-04-23
  • Fixed Date: 2026-05-26
  • CVE Number: CVE-2026-48899

Description

An improper access check allow unauthorized users to perform actions related to the installation of sampledata.

Affected Installs

Joomla! CMS versions 4.0.0-5.4.5,6.0.0-6.1.0

Solution

Upgrade to version 5.4.6,6.1.1

Contact

The JSST at the Joomla! Security Centre.

Reported By:  廖双, JSST

[20260514] - Core - Privilege escalation through com_users webservice endpoints

  • Project: Joomla!
  • SubProject: CMS
  • Impact: High
  • Severity: Moderate
  • Probability: Low
  • Versions: 4.0.0-5.4.5,6.0.0-6.1.0
  • Exploit type: Privilege Escalation
  • Reported Date: 2026-04-15
  • Fixed Date: 2026-05-26
  • CVE Number: CVE-2026-48904

Description

An improper access check allows privelege escalation through the com_users group editing webservice endpoint.

Affected Installs

Joomla! CMS versions 4.0.0-5.4.5,6.0.0-6.1.0

Solution

Upgrade to version 5.4.6,6.1.1

Contact

The JSST at the Joomla! Security Centre.

Reported By:  Christos Papakonstantinou, Cantina

[20260513] - Core - Privilege escalation through com_users batch task

  • Project: Joomla!
  • SubProject: CMS
  • Impact: High
  • Severity: High
  • Probability: Low
  • Versions: 4.0.0-5.4.5,6.0.0-6.1.0
  • Exploit type: Privilege Escalation
  • Reported Date: 2026-04-15
  • Fixed Date: 2026-05-26
  • CVE Number: CVE-2026-48898

Description

An improper access check allows privlege escalation through the com_users batch task.

Affected Installs

Joomla! CMS versions 4.0.0-5.4.5,6.0.0-6.1.0

Solution

Upgrade to version 5.4.6,6.1.1

Contact

The JSST at the Joomla! Security Centre.

Reported By:  Adrian Junge aka vulno, Christos Papakonstantinou, Cantina

[20260512] - Core - MFA Authentication Bypass

  • Project: Joomla!
  • SubProject: CMS
  • Impact: High
  • Severity: Moderate
  • Probability: Moderate
  • Versions: 4.0.0-5.4.5,6.0.0-6.1.0
  • Exploit type: Authentication Bypass
  • Reported Date: 2026-04-01
  • Fixed Date: 2026-05-26
  • CVE Number: CVE-2026-48897

Description

Incorrectly resetted session states to a vector that allows to bypass 2FA checks.

Affected Installs

Joomla! CMS versions 4.0.0-5.4.5,6.0.0-6.1.0

Solution

Upgrade to version 5.4.6,6.1.1

Contact

The JSST at the Joomla! Security Centre.

Reported By:  Morris Baumgarten-Egemole

[20260511] - Core - MFA Authentication Bypass

  • Project: Joomla!
  • SubProject: CMS
  • Impact: High
  • Severity: Moderate
  • Probability: Moderate
  • Versions: 4.0.0-5.4.5,6.0.0-6.1.0
  • Exploit type: Authentication Bypass
  • Reported Date: 2026-04-01
  • Fixed Date: 2026-05-26
  • CVE Number: CVE-2026-48896

Description

Insufficient state checks lead to a vector that allows to bypass 2FA checks.

Affected Installs

Joomla! CMS versions 4.0.0-5.4.5,6.0.0-6.1.0

Solution

Upgrade to version 5.4.6,6.1.1

Contact

The JSST at the Joomla! Security Centre.

Reported By:  Doyensec in collaboration with Claude and Anthropic Research, Christos Papakonstantinou, Cantina

[20260510] - Core - Path traversal in com_media webservice endpoint

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Moderate
  • Probability: Low
  • Versions: 4.0.0-5.4.5,6.0.0-6.1.0
  • Exploit type: Path traversal
  • Reported Date: 2026-04-15
  • Fixed Date: 2026-05-26
  • CVE Number: CVE-2026-40384

Description

An improper validation of the search parameter of the com_media files API endpoint leads to a path traversal vulnerability.

Affected Installs

Joomla! CMS versions 4.0.0-5.4.5,6.0.0-6.1.0

Solution

Upgrade to version 5.4.6,6.1.1

Contact

The JSST at the Joomla! Security Centre.

Reported By:  Doyensec in collaboration with Claude and Anthropic Research

[20260509] - Core - LFI in HTMLView layout parameter

  • Project: Joomla!
  • SubProject: CMS
  • Impact: High
  • Severity: High
  • Probability: Low
  • Versions: 3.2.1-5.4.5,6.0.0-6.1.0
  • Exploit type: Local File Inclusion
  • Reported Date: 2026-04-15
  • Fixed Date: 2026-05-26
  • CVE Number: CVE-2026-40383

Description

An improper validation of user-supplied input leads to a local file inclusion vulnerability.

Affected Installs

Joomla! CMS versions 3.2.1-5.4.5,6.0.0-6.1.0

Solution

Upgrade to version 5.4.6,6.1.1

Contact

The JSST at the Joomla! Security Centre.

Reported By:  Doyensec in collaboration with Claude and Anthropic Research

[20260508] - Core - Improper access check in com_config webservice endpoints

  • Project: Joomla!
  • SubProject: CMS
  • Impact: High
  • Severity: Moderate
  • Probability: Low
  • Versions: 4.0.0-5.4.5,6.0.0-6.1.0
  • Exploit type: Incorrect Access Control
  • Reported Date: 2026-04-15
  • Fixed Date: 2026-05-26
  • CVE Number: CVE-2026-35223

Description

An improper access check allows unauthorized access to com_config webservice endpoints.

Affected Installs

Joomla! CMS versions 4.0.0-5.4.5,6.0.0-6.1.0

Solution

Upgrade to version 5.4.6,6.1.1

Contact

The JSST at the Joomla! Security Centre.

Reported By:  Rishi Shakya, Qi Deng

[20260507] - Core - Authenticated blind SQLi in com_tags

  • Project: Joomla!
  • SubProject: CMS
  • Impact: High
  • Severity: Moderate
  • Probability: Low
  • Versions: 4.0.0-5.4.5,6.0.0-6.1.0
  • Exploit type: SQLi
  • Reported Date: 2026-03-31
  • Fixed Date: 2026-05-26
  • CVE Number: CVE-2026-352212

Description

Improperly validated order clauses lead to a SQL injection vulnerability in com_tags.

Affected Installs

Joomla! CMS versions 4.0.0-5.4.5,6.0.0-6.1.0

Solution

Upgrade to version 5.4.6,6.1.1

Contact

The JSST at the Joomla! Security Centre.

Reported By:  Adrian Junge aka vurlo, Federico Brasili

[20260506] - Core - Authenticated blind SQLi in com_finder

  • Project: Joomla!
  • SubProject: CMS
  • Impact: High
  • Severity: Moderate
  • Probability: Moderate
  • Versions: 5.4.0-5.4.5,6.0.0-6.1.0
  • Exploit type: SQLi
  • Reported Date: 2026-03-31
  • Fixed Date: 2026-05-26
  • CVE Number: CVE-2026-35221

Description

Improperly built filter clauses lead to a SQL injection vulnerability in the search query for com_finder.

Affected Installs

Joomla! CMS versions 5.4.0-5.4.5,6.0.0-6.1.0

Solution

Upgrade to version 5.4.6,6.1.1

Contact

The JSST at the Joomla! Security Centre.

Reported By:  Adrian Junge aka vurlo

[20260505] - Core - CSRF in user activation endpoint

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Moderate
  • Probability: Moderate
  • Versions: 6.0.0-6.1.0
  • Exploit type: CSRF
  • Reported Date: 2026-03-28
  • Fixed Date: 2026-05-26
  • CVE Number: CVE-2026-35220

Description

Lack of CSRF token validation lead to a CSRF attack vector in the admin activation endpoint of com_users.

Affected Installs

Joomla! CMS versions 6.0.0-6.1.0

Solution

Upgrade to version 6.1.1

Contact

The JSST at the Joomla! Security Centre.

Reported By:  Sun HuangnSec

[20260504] - Core - XSS in readmore links

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Moderate
  • Probability: Low
  • Versions: 4.0.0-5.4.5, 6.0.0-6.1.0
  • Exploit type: XSS
  • Reported Date: 2026-04-14
  • Fixed Date: 2026-05-26
  • CVE Number: CVE-2026-30895

Description

Lack of output escaping leads to a XSS vector in the content history component.

Affected Installs

Joomla! CMS versions 4.0.0-5.4.5, 6.0.0-6.1.0

Solution

Upgrade to version 5.4.6 or 6.1.1

Contact

The JSST at the Joomla! Security Centre.

Reported By:  peterhulst

[20260503] - Core - XSS in com_contenthistory

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Moderate
  • Probability: Low
  • Versions: 3.0.0-5.4.5, 6.0.0-6.1.0
  • Exploit type: XSS
  • Reported Date: 2026-04-01
  • Fixed Date: 2026-05-26
  • CVE Number: CVE-2026-30894

Description

Lack of output escaping leads to a XSS vector in the content history component.

Affected Installs

Joomla! CMS versions 3.0.0-5.4.5, 6.0.0-6.1.0

Solution

Upgrade to version 5.4.6 or 6.1.1

Contact

The JSST at the Joomla! Security Centre.

Reported By:  Phan Phan Hai Long

[20260502] - Core - XSS in com_associations

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Moderate
  • Probability: Low
  • Versions: 4.0.0-5.4.5, 6.0.0-6.1.0
  • Exploit type: XSS
  • Reported Date: 2026-04-01
  • Fixed Date: 2026-05-26
  • CVE Number: CVE-2026-25901

Description

Lack of output escaping leads to a XSS vector in the multilingual associations component.

Affected Installs

Joomla! CMS versions 4.0.0-5.4.5, 6.0.0-6.1.0

Solution

Upgrade to version 5.4.6 or 6.1.1

Contact

The JSST at the Joomla! Security Centre.

Reported By:  vnth4nhnt from CyStack, Pavel Kohout from Aisle Research

[20260501] - Core - XSS in feed modules

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Moderate
  • Probability: Low
  • Versions: 3.0.0-5.4.5, 6.0.0-6.1.0
  • Exploit type: XSS
  • Reported Date: 2026-03-28
  • Fixed Date: 2026-05-26
  • CVE Number: CVE-2026-25900

Description

Lack of output escaping leads to a XSS vector in the feed modules.

Affected Installs

Joomla! CMS versions 3.0.0-5.4.5, 6.0.0-6.1.0

Solution

Upgrade to version 5.4.6 or 6.1.1

Contact

The JSST at the Joomla! Security Centre.

Reported By:  Mohamed Elabbas, Sun Huang

[20260301] - Core - ACL hardening in com_ajax

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Probability: Moderate
  • Versions: 3.0.0-5.4.3, 6.0.0-6.0.3
  • Exploit type: Incorrect Access Control
  • Reported Date: 2026-03-11
  • Fixed Date: 2026-03-31
  • CVE Number: CVE-2026-21629

Description

The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party developers.

Affected Installs

Joomla! CMS versions 3.0.0-5.4.3, 6.0.0-6.0.3

Solution

Upgrade to version 5.4.4 or 6.0.4

Contact

The JSST at the Joomla! Security Centre.

Reported By:  JSST

[20260302] - Core - SQL injection in com_content articles webservice endpoint

  • Project: Joomla!
  • SubProject: CMS
  • Impact: High
  • Severity: Low
  • Probability: Moderate
  • Versions: 4.0.0-5.4.3, 6.0.0-6.0.3
  • Exploit type: SQLi
  • Reported Date: 2026-03-05
  • Fixed Date: 2026-03-31
  • CVE Number: CVE-2026-21630

Description

Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint.

Affected Installs

Joomla! CMS versions 4.0.0-5.4.3, 6.0.0-6.0.3

Solution

Upgrade to version 5.4.4 or 6.0.4

Contact

The JSST at the Joomla! Security Centre.

Reported By:  Antonio Morales from GitHub Security Lab Taskflow Agent / vnth4nhnt from CyStack

[20260303] - Core - XSS vector in com_associations comparison view

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Moderate
  • Probability: Low
  • Versions: 4.0.0-5.4.3, 6.0.0-6.0.3
  • Exploit type: XSS
  • Reported Date: 2026-03-11
  • Fixed Date: 2026-03-31
  • CVE Number: CVE-2026-21631

Description

Lack of output escaping leads to a XSS vector in the multilingual associations component

Affected Installs

Joomla! CMS versions 4.0.0-5.4.3, 6.0.0-6.0.3

Solution

Upgrade to version 5.4.4 or 6.0.4

Contact

The JSST at the Joomla! Security Centre.

Reported By:  Shirsendu Mondal & Md Tanzimul Alam Fahim, UNC Pembroke

Page 1 of 14