Joomla! User Group Jeddah

Security Announcements

• [20260916] - Core - XSS filter bypass in InputFilter via whitespace characters in HTML data URIs

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Moderate
  • Probability: Low
  • Versions: 1.5.0-5.4.8,6.0.0-6.1.3
  • Exploit type: XSS
  • Reported Date: 2026-08-19
  • Fixed Date: 2026-09-25
  • CVE Number: CVE-2026-92232

  Description

  The cleanAttribute method removes HTML data URIs, however injected whitespaces characters could circumvent that cleanup, causing an XSS vector.

  Affected Installs

  Joomla! CMS versions 1.5.0-5.4.8, 6.0.0-6.1.3

  Solution

  Upgrade to version 5.4.9, 6.1.4

  Contact

  The JSST at the Joomla! Security Centre.

  Reported By:  arib06

• [20260915] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Moderate
  • Probability: Low
  • Versions: 1.5.0-5.4.8,6.0.0-6.1.3
  • Exploit type: XSS
  • Reported Date: 2026-08-02
  • Fixed Date: 2026-09-25
  • CVE Number: CVE-2026-92231

  Description

  The checkAttribute method normalized an attribute value before testing it against the "javascript:" scheme regex, however without decoding HTML5 entities beforehand, causing an XSS vector.

  Affected Installs

  Joomla! CMS versions 1.5.0-5.4.8, 6.0.0-6.1.3

  Solution

  Upgrade to version 5.4.9, 6.1.4

  Contact

  The JSST at the Joomla! Security Centre.

  Reported By:  Netanel Stern

• [20260914] - Core - MFA Authentication Bypass through rememberme cookies

  • Project: Joomla!
  • SubProject: CMS
  • Impact: High
  • Severity: Moderate
  • Probability: Moderate
  • Versions: 4.0.0-5.4.8,6.0.0-6.1.3
  • Exploit type: Authentication Bypass
  • Reported Date: 2026-09-10
  • Fixed Date: 2026-09-25
  • CVE Number: CVE-2026-92227

  Description

  The premature issuance of an rememberme cookie leads to a MFA bypass vulnerability.

  Affected Installs

  Joomla! CMS versions 4.0.0-5.4.8, 6.0.0-6.1.3

  Solution

  Upgrade to version 5.4.9, 6.1.4

  Contact

  The JSST at the Joomla! Security Centre.

  Reported By:  Google and Ada Logics, Mukul Goyal

• [20260913] - Core - Improper ACL checks for varous webservice edit tasks

  • Project: Joomla!
  • SubProject: CMS
  • Impact: High
  • Severity: Moderate
  • Probability: Moderate
  • Versions: 4.0.0-5.4.8,6.0.0-6.1.3
  • Exploit type: Incorrect Access Control
  • Reported Date: 2026-09-10
  • Fixed Date: 2026-09-25
  • CVE Number: CVE-2026-92226

  Description

  An improper access check allows unauthorized users to perform edit actions on otherwise uneditable items.

  Affected Installs

  Joomla! CMS versions 4.0.0-5.4.8, 6.0.0-6.1.3

  Solution

  Upgrade to version 5.4.9, 6.1.4

  Contact

  The JSST at the Joomla! Security Centre.

  Reported By:  Google and Ada Logics

• [20260912] - Core - XSS in module list

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Moderate
  • Probability: Low
  • Versions: 4.0.0-5.4.8,6.0.0-6.1.3
  • Exploit type: XSS
  • Reported Date: 2026-09-10
  • Fixed Date: 2026-09-25
  • CVE Number: CVE-2026-92225

  Description

  The module list layout did not properly escape user supplied values, leading to an XSS vector.

  Affected Installs

  Joomla! CMS versions 4.0.0-5.4.8, 6.0.0-6.1.3

  Solution

  Upgrade to version 5.4.9, 6.1.4

  Contact

  The JSST at the Joomla! Security Centre.

  Reported By:  Google and Ada Logics

• [20260910] - Core - Improper ACL checks for workflow stage changes

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Moderate
  • Probability: Moderate
  • Versions: 5.0.0-5.4.8,6.0.0-6.1.3
  • Exploit type: Incorrect Access Control
  • Reported Date: 2026-08-27
  • Fixed Date: 2026-09-25
  • CVE Number: CVE-2026-92223

  Description

  An improper access check allows unauthorized users to update the workflow stage of inaccessible contents.

  Affected Installs

  Joomla! CMS versions 5.0.0-5.4.8, 6.0.0-6.1.3

  Solution

  Upgrade to version 5.4.9, 6.1.4

  Contact

  The JSST at the Joomla! Security Centre.

  Reported By:  Faceless

• [20260909] - Core - SSRF vectors in various core extensions

  • Project: Joomla!
  • SubProject: CMS
  • Impact: High
  • Severity: High
  • Probability: Low
  • Versions: 3.0.0-5.4.8,6.0.0-6.1.3
  • Exploit type: SSRF
  • Reported Date: 2026-08-24
  • Fixed Date: 2026-09-25
  • CVE Number: CVE-2026-92222

  Description

  URLs used for serverside requests were improperly validated, leading to SSRF vectors.

  Affected Installs

  Joomla! CMS versions 4.0.0-5.4.8, 6.0.0-6.1.3

  Solution

  Upgrade to version 5.4.9, 6.1.4

  Contact

  The JSST at the Joomla! Security Centre.

  Reported By:  Aria Akhavan, Calif.io in collaboration with Anthropic

• [20260908] - Core - XSS in HTML Mail Templates

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Moderate
  • Probability: Moderate
  • Versions: 4.0.0-5.4.8,6.0.0-6.1.3
  • Exploit type: XSS
  • Reported Date: 2026-08-24
  • Fixed Date: 2026-09-25
  • CVE Number: CVE-2026-90918

  Description

  The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions.

  Affected Installs

  Joomla! CMS versions 4.0.0-5.4.8, 6.0.0-6.1.3

  Solution

  Upgrade to version 5.4.9, 6.1.4

  Contact

  The JSST at the Joomla! Security Centre.

  Reported By:  Joe Grey / GitHub @StressTestor

• [20260911] - Core - XSS in link toolbar layout

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Moderate
  • Probability: Low
  • Versions: 4.0.0-5.4.8,6.0.0-6.1.3
  • Exploit type: XSS
  • Reported Date: 2026-09-10
  • Fixed Date: 2026-09-25
  • CVE Number: CVE-2026-92224

  Description

  The link toolbar layout did not properly escape inputs, leading to an XSS vector.

  Affected Installs

  Joomla! CMS versions 4.0.0-5.4.8, 6.0.0-6.1.3

  Solution

  Upgrade to version 5.4.9, 6.1.4

  Contact

  The JSST at the Joomla! Security Centre.

  Reported By:  Google and Ada Logics

• [20260907] - Core - Improper ACL checks in outputs for tagged items

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Moderate
  • Probability: Moderate
  • Versions: 4.0.0-5.4.8,6.0.0-6.1.3
  • Exploit type: Incorrect Access Control
  • Reported Date: 2026-07-28
  • Fixed Date: 2026-09-25
  • CVE Number: CVE-2026-90917

  Description

  An improper access check allows unauthorized users to view content items from inaccessible categories.

  Affected Installs

  Joomla! CMS versions 4.0.0-5.4.8, 6.0.0-6.1.3

  Solution

  Upgrade to version 5.4.9, 6.1.4

  Contact

  The JSST at the Joomla! Security Centre.

  Reported By:  Amin İsayev