CVE-2026-72531: 
Joomla vulnerability analysis and mitigation

CVE-2026-72531 is an improper access control vulnerability in Joomla! CMS affecting the custom fields webservice endpoints. Tracked under Joomla security advisory [20260804], it allows users with high-level privileges to create custom fields for components they should not have access to, bypassing ACL restrictions. Affected versions include Joomla! 4.0.0–5.4.7 and 6.0.0–6.1.2. It carries a CVSS v4.0 base score of 5.1 (Medium), assigned by the Joomla! Project (GitHub Advisory, Joomla Security Centre). The vulnerability was published on August 18, 2026.

The root cause is classified as CWE-284 (Improper Access Control), where the Joomla! webservice endpoints responsible for managing custom fields fail to properly validate whether the requesting user has permission to interact with the target component. An attacker with high-privilege credentials can send crafted API requests to the custom fields webservice endpoint, bypassing ACL checks and creating fields for components that should be inaccessible to them. No special attack requirements or user interaction are needed beyond possessing a high-privilege account (GitHub Advisory, Joomla Security Centre).

Successful exploitation allows an unauthorized or improperly privileged user to create custom fields for Joomla! components beyond their authorization scope, resulting in limited confidentiality and integrity impacts on the vulnerable system. This could lead to unauthorized modification of the site's data structure and field configuration, potentially enabling data manipulation or information disclosure within the CMS. Availability is not impacted, and there is no assessed impact on subsequent systems (GitHub Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly/ENISA). The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is not automatable and requires an attacker to already possess high-privilege credentials on the target Joomla! instance (GitHub Advisory).

Joomla! has released patched versions addressing this vulnerability; administrators should upgrade to Joomla! 5.4.8 or later (for the 4.x/5.x branch) and 6.1.3 or later (for the 6.x branch). As an interim measure, restrict webservice API access to only authorized administrative users and review ACL configurations for custom fields endpoints. Verify that no unauthorized custom fields have been created for restricted components after applying the patch (Joomla Security Centre, GitHub Advisory).