Joomla! Core - [20260808] - Improper ACL checks for batch copy actions in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform copy batch operations on uneditable items.

According to its self-reported version number, the version of Joomla! installed on the remote host is prior to 5.4.8 / 6.1.3. It is, therefore, affected by multiple vulnerabilities:

 - Lack of output processing allows a response header injection in the multiple download views, leading to reflected file download / content-type confusion. (CVE-2026-71572)

 - An improper implementation prevents configured CORS origins from being properly validated in CORS requests. (CVE-2026-71573)

 - Improper access validation permits unauthorized users to execute mutation operations through webservice endpoints. (CVE-2026-71574)

 - An improper access check allows unauthorized users to create fields for inaccessible components via the custom fields webservice endpoints. (CVE-2026-72531)

 - An improper access check allows unauthorized users to create categories for inaccessible components via the category webservice endpoints. (CVE-2026-72532)

 - Improper escaping flags create a cross-site scripting (XSS) vulnerability through schema.org outputs. (CVE-2026-73336)

 - Insufficient state checks lead to a vector that allows bypassing multi-factor authentication (MFA) checks. (CVE-2026-73337)

 - An improper access check allows unauthorized users to perform copy batch operations on uneditable items. (CVE-2026-73371)

 - An improper access check injects contact information for inaccessible contact items into schema.org snippets. (CVE-2026-73372)

 - The default list of dangerous file types does not include SHTML files, potentially allowing unrestricted uploads that could execute as code on servers configured to process them. (CVE-2026-73373)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
115460	Joomla! 6.x < 6.1.3 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
115459	Joomla! 5.x < 5.4.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high

Detections

Analytics

CVE-2026-73371

medium

Tenable Plugins

high

high