{"id":"CVE-2023-23752","kind":"vulnerability","aliases":["CVE-2023-23752"],"related":[],"title":"joomla joomla\\!: An issue was discovered in Joomla! 4.0.0 through 4.2.7","description":"Joomla! contains an improper access control vulnerability that allows unauthorized access to webservice endpoints.\n\nCISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","summary":"Joomla! has an improper access control flaw that lets unauthenticated users reach webservice API endpoints they should not see. Attackers can read data exposed through those endpoints, including user details and configuration, and the flaw is known to be actively exploited.","severity":"high","cvss":5.3,"epss":null,"exploited":true,"exploited_at":"2024-01-08T00:00:00+00:00","products":[{"name":"Joomla! Joomla!","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"joomla joomla\\!","fixed":["4.2.8"],"affected":">= 4.0.0, < 4.2.8","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","joomla","php","runtime","self-hosted"],"not_affected_if":["api-disabled","non-joomla"],"how_to_check":"Check the Joomla version under System > System Information; versions 4.0.0 through 4.2.7 are affected per public reports, which the sources here do not confirm.\nReview web server logs for requests to /api/index.php/v1/users or /api/index.php/v1/config.","fix":"Upgrade Joomla to a fixed release (4.2.8 or later per public reports, not confirmed by these sources).\nIf upgrading is not possible, block public access to /api/ at the web server or disable the Web Services API.","status":"open","published_at":"2023-02-16T17:15:10+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:02:34+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-23T21:02:34Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Joomla to a fixed release (4.2.8 or later per public reports, not confirmed by these sources).\nIf upgrading is not possible, block public access to /api/ at the web server or disable the Web Services API.","reach":"internet","impact":"high","summary":"Joomla! has an improper access control flaw that lets unauthenticated users reach webservice API endpoints they should not see. Attackers can read data exposed through those endpoints, including user details and configuration, and the flaw is known to be actively exploited.","category":"runtime","who_cares":["joomla","self-hosted","php"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated attacker reads user records and site configuration via API","analyst_note":"Confirm affected and fixed version range and exact endpoints from the Joomla security advisory and the CISA KEV entry; sources here give no versions.","how_to_check":"Check the Joomla version under System > System Information; versions 4.0.0 through 4.2.7 are affected per public reports, which the sources here do not confirm.\nReview web server logs for requests to /api/index.php/v1/users or /api/index.php/v1/config.\nunknown","needs_analyst":true,"not_affected_if":["api-disabled","non-joomla"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000517,"input_tokens":2794,"output_tokens":475,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2023':13A,16A '-23752':14A,17A '4.0.0':9A '4.2.7':11A 'access':33B,74C,80C 'action':86C 'activ':68B 'allow':78C 'api':42B 'appli':87C 'attack':48B 'cisa':84C 'configur':60B 'contain':71C 'control':34B,75C 'cve':12A,15A 'data':51B 'detail':58B 'discontinu':93C 'discov':6A 'endpoint':43B,55B,83C 'exploit':22B,69B 'expos':52B 'flaw':35B,63B 'host':28B 'improp':32B,73C 'includ':56B 'instruct':91C 'issu':4A 'joomla':1A,2A,8A,18A,19A,20A,21A,23B,29B,70C 'known':65B 'let':37B 'mitig':88C,99C 'per':89C 'php':24B 'product':97C 'reach':40B 'read':50B 'requir':85C 'runtim':25B 'see':47B 'self':27B 'self-host':26B 'unauthent':38B 'unauthor':79C 'unavail':101C 'use':94C 'user':39B,57B 'vendor':90C 'vulner':76C 'webservic':41B,82C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-02-16T17:15:10+00:00","kev":{"dateAdded":"2024-01-08","dueDate":"2024-01-29","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2023-23752","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-23752","severity":null,"published_at":"2024-01-08T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T11:39:15+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-23752","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23752","severity":null,"published_at":"2023-02-16T17:15:10+00:00","modified_at":"2026-06-17T05:37:50+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}