Improper access control in Joomla! - CVE-2026-73371
Published: August 18, 2026
Vulnerability identifier: #VU144195
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-73371
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to perform unauthorized copy batch operations on uneditable items.
The vulnerability exists due to improper access control in batch copy actions when handling copy batch requests for uneditable items. A remote user can send a crafted batch copy request to perform unauthorized copy batch operations on uneditable items.
Affected software
Joomla!
How to mitigate CVE-2026-73371
Install security update from vendor's website.
Joomla! - addressed in versions 5.4.8, 6.1.3