Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The profile.save controller did not check the login state of a user, allowing the creation of guest-level users on sites without active user registration.

According to its self-reported version number, the version of Joomla! installed on the remote host is 1.5.x prior to 5.4.9 or 6.x prior to 6.1.4. It is, therefore, affected by multiple vulnerabilities:

 - Lack of escaping leads to XSS vulnerabilities in the link method of the HTMLHelper. (CVE-2026-90906)

 - The profile.save controller did not check the login state of a user, allowing the creation of guest-level users on sites without active user registration. (CVE-2026-90907)

 - An improper access check allows unauthorized users to perform mutation actions in access level webservice endpoints. (CVE-2026-90913)

 - Lack of escaping leads to an XSS vulnerability in the generic audio and video output layouts. (CVE-2026-90914)

 - An improper validation of the cache group name allowed path traversals in the file storage of the caching layer, resulting in arbitrary directory deletions. (CVE-2026-90915)

 - An improper access check in the content history comparison view allows unauthorized users to view inaccessible contents. (CVE-2026-90916)

 - An improper access check in outputs for tagged items allows unauthorized users to view content items from inaccessible categories. (CVE-2026-90917)

 - The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions. (CVE-2026-90918)

 - URLs used for server-side requests were improperly validated, leading to server-side request forgery (SSRF) vectors in various core extensions. (CVE-2026-92222)

 - An improper access check allows unauthorized users to update the workflow stage of inaccessible contents. (CVE-2026-92223)

 - The link toolbar layout did not properly escape inputs, leading to an XSS vector. (CVE-2026-92224)

 - The module list layout did not properly escape user supplied values, leading to an XSS vector. (CVE-2026-92225)

 - An improper access check allows unauthorized users to perform edit actions on otherwise uneditable items via various webservice edit tasks. (CVE-2026-92226)

 - The premature issuance of a rememberme cookie leads to a multi-factor authentication (MFA) bypass vulnerability. (CVE-2026-92227)

 - The InputFilter checkAttribute method normalized an attribute value before testing it against the 'javascript:' scheme regex without first decoding HTML5 entities, causing an XSS filter bypass. (CVE-2026-92231)

 - The InputFilter cleanAttribute method removes HTML data URIs, however injected whitespace characters could circumvent that cleanup, causing an XSS filter bypass. (CVE-2026-92232)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the instance of Joomla! running on the remote web server is 1.5.x prior to 5.4.9 or 6.0.x prior to 6.1.4. It is, therefore, affected by multiple vulnerabilities.

  - Joomla! Core - [20260915] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch in     Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The checkAttribute method normalized an attribute value before testing     it against the javascript: scheme regex, however without decoding HTML5 entities beforehand, causing an     XSS vector. (CVE-2026-92231)

  - Joomla! Core - [20260901] - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - Lack of     escaping leads to XSS vulnerabilities in the link method of the HTML Helper. (CVE-2026-90906)

  - Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in     Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The profile.save controller did not check the login state of a user,     allowing the creation of guest-level users on sites without active user registration. (CVE-2026-90907)

  - Joomla! Core - [20260903] - Core - Improper ACL checks for access level webservice endpoints in Joomla     4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to perform mutation actions     in access level endpoints. (CVE-2026-90913)

  - Joomla! Core - [20260904] - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8,     6.0.0-6.1.3 - Lack of escaping leads to an XSS vulnerability in the generic audio and video output     layouts. (CVE-2026-90914)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the instance of Joomla! running on the remote web server is 1.5.x prior to 5.4.9 or 6.0.x prior to 6.1.4. It is, therefore, affected by multiple vulnerabilities.

  - Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in     Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The profile.save controller did not check the login state of a user,     allowing the creation of guest-level users on sites without active user registration. (CVE-2026-90907)

  - Joomla! Core - [20260901] - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - Lack of     escaping leads to XSS vulnerabilities in the link method of the HTML Helper. (CVE-2026-90906)

  - Joomla! Core - [20260915] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch in     Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The checkAttribute method normalized an attribute value before testing     it against the 'javascript:' scheme regex, however without decoding HTML5 entities beforehand, causing an     XSS vector. (CVE-2026-92231)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
115683	Joomla! 6.x < 6.1.4 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
115682	Joomla! 1.5.x < 5.4.9 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
362486	Joomla 1.5.x < 5.4.9 / 6.0.x < 6.1.4 Multiple Vulnerabilities (joomla-6-1-4-5-4-9-security-bugfix-release)	Nessus	CGI abuses	Remote	high
362485	Joomla 1.5.x < 5.4.9 / 6.0.x < 6.1.4 Multiple Vulnerabilities (joomla-6-1-4-5-4-9-security-bugfix-release)	Nessus	CGI abuses	Remote	high

Detections

Analytics

CVE-2026-90907

medium

Tenable Plugins

high

high

high

high