CVE-2026-23899: Improper Access Check in Joomla! com_config Webservices

Vulnerability ID: CVE-2026-23899

CVSS Score: 8.8

Published: 2026-04-01

CVE-2026-23899 is a critical authorization bypass vulnerability within the Joomla! CMS webservice API. Due to an improper access check in the com_config component, authenticated low-privileged users can read and modify the global configuration, leading to the exposure of database credentials and the application secret key.

TL;DR

An authorization bypass in Joomla! webservice endpoints allows authenticated low-privileged users to read and modify sensitive configuration settings, resulting in total system compromise.

⚠️ Exploit Status: POC

Technical Details

CWE ID : CWE-284

Attack Vector : Network

Privileges Required : Low (API Token)

CVSS v3.1 Score : 8.8

EPSS Score : 0.00001

Exploit Status : Proof of Concept

Affected Systems

Joomla! CMS

Joomla! CMS : 4.0.0 - 5.4.3 (Fixed in: 5.4.4 )

Joomla!…