SB2026093062 - Multiple vulnerabilities in Joomla!
Published: September 30, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 16 vulnerabilities.
1) Cross-site scripting (CVE-ID: CVE-2026-92232)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote attacker to execute arbitrary script in a victim's browser.
The vulnerability exists due to improper neutralization of input during web page generation in the InputFilter cleanAttribute method when handling HTML data URIs containing injected whitespace characters. A remote attacker can inject whitespace characters into an HTML data URI to execute arbitrary script in a victim's browser.
User interaction is required to view content containing the crafted URI.
2) Cross-site scripting (CVE-ID: CVE-2026-92231)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote attacker to execute arbitrary script in a victim's browser.
The vulnerability exists due to improper neutralization of HTML5 entities in the InputFilter checkAttribute method when processing attribute values. A remote attacker can submit a crafted attribute value to execute arbitrary script in a victim's browser.
3) Improper Authentication (CVE-ID: CVE-2026-92227)
CWE-ID: CWE-287 - Improper Authentication
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass multi-factor authentication.
The vulnerability exists due to premature issuance of a rememberme cookie in Joomla! CMS rememberme cookie handling when handling rememberme cookies. A remote user can use a prematurely issued rememberme cookie to bypass multi-factor authentication.
4) Missing Authorization (CVE-ID: CVE-2026-92226)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to modify otherwise uneditable items.
The vulnerability exists due to improper access control in web service edit tasks when handling edit requests. A remote user can perform edit actions on otherwise uneditable items to modify otherwise uneditable items.
5) Cross-site scripting (CVE-ID: CVE-2026-92225)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote user to execute arbitrary script.
The vulnerability exists due to improper neutralization of input during web page generation in the module list layout when displaying user-supplied values. A remote user can supply crafted values to execute arbitrary script.
6) Cross-site scripting (CVE-ID: CVE-2026-92224)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote attacker to execute arbitrary script in a victim's browser.
The vulnerability exists due to improper output neutralization in the link toolbar layout when processing user-supplied input. A remote attacker can submit crafted input to execute arbitrary script in a victim's browser.
7) Incorrect authorization (CVE-ID: CVE-2026-92223)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to update the workflow stage of inaccessible content.
The vulnerability exists due to improper access control in the workflow stage change functionality when updating workflow stages. A remote user can update the workflow stage of inaccessible content to update the workflow stage of inaccessible content.
8) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-92222)
CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform server-side request forgery.
The vulnerability exists due to improper validation of URLs in Joomla! CMS core extensions when handling URLs used for server-side requests. A remote attacker can supply a specially crafted URL to perform server-side request forgery.
9) Cross-site scripting (CVE-ID: CVE-2026-90918)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote attacker to execute arbitrary script in a victim's browser.
The vulnerability exists due to improper neutralization of input in the mail template feature when generating HTML email content. A remote attacker can inject crafted script content into affected mail templates to execute arbitrary script in a victim's browser.
The issue affects multiple extensions.
10) Incorrect authorization (CVE-ID: CVE-2026-90917)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose content items from inaccessible categories.
The vulnerability exists due to improper authorization checks in outputs for tagged items when handling requests for tagged content. A remote attacker can request tagged content to disclose content items from inaccessible categories.
11) Missing Authorization (CVE-ID: CVE-2026-90916)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose inaccessible content.
The vulnerability exists due to improper authorization in the content history comparison view when comparing content history. A remote user can access the comparison view to disclose inaccessible content.
12) Path traversal (CVE-ID: CVE-2026-90915)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to delete arbitrary directories.
The vulnerability exists due to improper validation of cache group names in the cache layer file storage when processing cache purge actions. A remote attacker can submit a cache group name containing path traversal sequences to delete arbitrary directories.
13) Cross-site scripting (CVE-ID: CVE-2026-90914)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote attacker to execute arbitrary script in a victim's browser.
The vulnerability exists due to improper neutralization of input during web page generation in the generic audio and video output layouts when rendering crafted media content. A remote attacker can supply crafted media content to execute arbitrary script in a victim's browser.
User interaction is required to render the crafted media content.
14) Missing Authorization (CVE-ID: CVE-2026-90913)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform unauthorized mutation actions.
The vulnerability exists due to improper access control in access level webservice endpoints when handling mutation actions. A remote attacker can send requests to the affected endpoints to perform unauthorized mutation actions.
15) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-90907)
CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to create guest-level user accounts.
The vulnerability exists due to authorization bypass through a user-controlled key in the profile.save controller when processing profile.save requests. A remote attacker can send a request to the profile.save controller to create guest-level user accounts.
User registration does not need to be active.
16) Cross-site scripting (CVE-ID: CVE-2026-90906)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote attacker to execute arbitrary script in a victim's browser.
The vulnerability exists due to improper neutralization of input during web page generation in the HTMLHelper::link method when rendering crafted link content. A remote attacker can supply crafted link content to execute arbitrary script in a victim's browser.
User interaction is required to render the crafted link content.
Remediation
Install update from vendor's website.
References
- https://developer.joomla.org/security-centre/1096-20260916-core-xss-filter-bypass-in-inputfilter-via-whitespace-characters-in-html-data-uris.html
- https://developer.joomla.org/security-centre/1095-20260915-core-xss-filter-bypass-in-inputfilter-via-html5-entity-decode-mismatch.html
- https://developer.joomla.org/security-centre/1094-20260914-core-mfa-authentication-bypass-through-rememberme-cookies.html
- https://developer.joomla.org/security-centre/1093-20260913-core-improper-acl-checks-for-varous-webservice-edit-tasks.html
- https://developer.joomla.org/security-centre/1092-20260912-core-xss-in-module-list.html
- https://developer.joomla.org/security-centre/1091-20260911-core-xss-in-link-toolbar-layout.html
- https://developer.joomla.org/security-centre/1090-20260910-core-improper-acl-checks-for-workflow-stage-changes.html
- https://developer.joomla.org/security-centre/1089-20260909-core-ssrf-vectors-in-various-core-extensions.html
- https://developer.joomla.org/security-centre/1088-20260908-core-xss-in-html-mail-templates.html
- https://developer.joomla.org/security-centre/1087-20260907-core-improper-acl-checks-in-outputs-for-tagged-items.html
- https://developer.joomla.org/security-centre/1086-20260906-core-improper-acl-checks-in-content-history-comparsion-view.html
- https://developer.joomla.org/security-centre/1085-20260905-core-arbitrary-directory-deletion-via-cache-purge-action.html
- https://developer.joomla.org/security-centre/1084-20260904-core-xss-in-the-generic-media-output-layouts.html
- https://developer.joomla.org/security-centre/1083-20260903-core-improper-acl-checks-for-user-level-webservice-endpoints.html
- https://developer.joomla.org/security-centre/1082-20260902-core-unauthorized-user-account-creation-via-profile-save-controller.html
- https://developer.joomla.org/security-centre/1081-20260901-core-xss-in-htmlhelper-link-method.html