CVE-2026-72532: Joomla! Core - [20260805] - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2
Published Aug 18, 2026
·Updated
Joomla! Core - [20260806] - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to create categories via webservices endpoints.
Affected Software
1 affected component
Joomla Joomla! Core>=4.0.0<=5.4.7, >=6.0.0<=6.1.2
Event History
Aug 18, 2026
CVE Published
via MITRE·04:03 PM
Data Sourced
via MITRE·04:03 PM
DescriptionWeakness
Frequently Asked Questions
1
Which Joomla! Core versions are affected?
Joomla! Core installations running versions 4.0.0 through 5.4.7 or 6.0.0 through 6.1.2 are affected.
2
What access does an attacker need to exploit this issue?
An unauthorized user can create categories through Joomla webservice endpoints because the access-control checks are improper.
3
How can administrators check for possible exploitation?
Review categories created through webservice endpoints for unexpected or unauthorized entries, particularly on affected versions. The provided information does not identify specific indicators beyond unauthorized category creation.