CVE-2026-76602: Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.3
Published Aug 22, 2026
·Updated
Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.3 - The order parameter in list models is used in queries without validation, allowing read SQLi vectors.
Affected Software
1 affected component
Joomla fabrikar.com<4.7.3
Event History
Aug 22, 2026
CVE Published
via MITRE·02:21 PM
Data Sourced
via MITRE·02:21 PM
DescriptionWeakness
Data Sourced
via NVD·03:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
The issue is described as unauthenticated, so an attacker does not need to log in before attempting exploitation. Exposure depends on whether the affected Fabrik list functionality is reachable by the attacker.
2
What access or input is needed to trigger the vulnerability?
An attacker needs to control the order parameter used by Fabrik list models. The parameter is incorporated into database queries without validation, creating read-oriented SQL injection vectors.
3
Which versions are affected?
Fabrik versions earlier than 4.7.3 are affected according to the available information.