CVE-2026-76603: Joomla Extension - fabrikar.com - Unauthenticated row disclosure via form.inlineedit in Fabrik < 4.7.3
Published Aug 22, 2026
·Updated
Joomla Extension - fabrikar.com - Unauthenticated row disclosure via form.inlineedit in Fabrik < 4.7.3 - The inineedit form controller does not perform any access checks, disclosing items to unauthorized users.
Affected Software
1 affected component
fabrikar.com<4.7.3
Event History
Aug 22, 2026
CVE Published
via MITRE·02:21 PM
Data Sourced
via MITRE·02:21 PM
DescriptionWeakness
Data Sourced
via NVD·03:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected?
Fabrik versions earlier than 4.7.3 are affected. The issue is in the inlineedit form controller.
2
Does exploitation require authentication?
No. The disclosure can be triggered by an unauthenticated user because the affected controller does not perform access checks.
3
What information can an attacker obtain?
An attacker can disclose items or rows that should be restricted to authorized users. The available data does not specify which fields or records may be exposed.