CVE-2026-73372: 
Joomla vulnerability analysis and mitigation

CVE-2026-73372 is an improper access control vulnerability in Joomla! CMS that allows contact information from restricted (inaccessible) contact items to be injected into schema.org structured data snippets. It affects Joomla! CMS versions 5.1.0–5.4.7 and 6.0.0–6.1.2. The vulnerability was disclosed on August 18, 2026, with a patch made available the same day. It carries a CVSS v4.0 base score of 5.1 (Medium) (GitHub Advisory, Joomla Security Centre).

The root cause is classified as CWE-284 (Improper Access Control): Joomla's schema.org snippet generation logic fails to properly enforce Access Control List (ACL) restrictions when embedding contact data into structured metadata. As a result, contact information belonging to items that should be inaccessible to the current user is included in the rendered schema.org output visible in page source. Exploitation requires high privileges (e.g., a backend user role) to trigger the injection, but the exposed data may be readable by unauthenticated visitors viewing the resulting page markup. No public proof-of-concept code has been identified (GitHub Advisory, Joomla Security Centre).

Successful exploitation results in unauthorized disclosure of contact information (e.g., names, email addresses, phone numbers) from Joomla contact items that are configured as restricted under the site's ACL. The impact is limited to confidentiality — there is no integrity or availability impact, and the exposure is confined to the vulnerable Joomla instance itself with no lateral movement potential. This could expose personally identifiable information (PII) of contacts that administrators intended to keep private (GitHub Advisory, Joomla Security Centre).

There is no evidence of active in-the-wild exploitation, and no public proof-of-concept has been published as of the disclosure date. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. NVD SSVC assessment classifies exploitation as "none" and the vulnerability as non-automatable (GitHub Advisory, Joomla Security Centre).

Joomla has released patches addressing this vulnerability: users on the 5.x branch should upgrade to a version beyond 5.4.7, and users on the 6.x branch should upgrade to a version beyond 6.1.2. As an interim measure, administrators should review ACL settings for all contact items to ensure access restrictions are correctly configured, and monitor schema.org snippet output for unexpected contact data exposure. Upgrading to the latest patched release is the recommended remediation (Joomla Security Centre, GitHub Advisory).