Live › vulnerability › CVE-2023-23752
Go to dashboardJoomla! has an improper access control flaw that lets unauthenticated users reach webservice API endpoints they should not see. Attackers can read data exposed through those endpoints, including user details and configuration, and the flaw is known to be actively exploited.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Joomla! Joomla! | vendor | – | – |
| joomla joomla\! | vendor | >= 4.0.0, < 4.2.8 | 4.2.8 |
4.0.0 through 4.2.7 are affected per public reports, which the sources here do not confirm4.2.8 or later per public reports, not confirmed by these sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Joomla! contains an improper access control vulnerability that allows unauthorized access to webservice endpoints.
CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
This page as .md · .json · in your agent: get_signal("CVE-2023-23752")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.