An improper access check allows unauthorized access to webservice endpoints.

According to its self-reported version, the instance of Joomla! running on the remote web server is 3.x prior to 5.4.4, or 6.x prior to 6.0.3. It is, therefore, affected by multiple vulnerabilities.

 - An ACL hardening in com_ajax, the ajax component was excluded from the default logged-in-user check in the administrative area.

 - An SQL injection in com_content articles webservice endpoint

 - An XSS vector in com_associations comparison view

 - An XSS vectors in various article title outputs

 - An Arbitrary file deletion in com_joomlaupdate

 - An Improper access check in webservice endpoints

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the instance of Joomla! running on the remote web server is 4.0.x prior to 5.4.4 or 6.0.x prior to 6.0.4. It is, therefore, affected by a vulnerability.

  - An improper access check allows unauthorized access to webservice endpoints. (CVE-2026-23899)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
115207	Joomla! 6.x < 6.0.3 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
115206	Joomla! 3.x < 5.4.4 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
304414	Joomla 4.0.x < 5.4.4 / 6.0.x < 6.0.4 Joomla 6.0.4 & 5.4.4 Security & Bugfix Release (5944-joomla-6-0-4-5-4-4-security-bugfix-release)	Nessus	CGI abuses	high

Detections

Analytics

CVE-2026-23899

high

Tenable Plugins

high

high

high