---
id: "CVE-2023-23752"
kind: "vulnerability"
aliases: ["CVE-2023-23752"]
title: "joomla joomla\\!: An issue was discovered in Joomla! 4.0.0 through 4.2.7"
severity: "high"
cvss: 5.3
epss: null
exploited: true
status: "open"
category: "runtime"
products: [{"name": "Joomla! Joomla!", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "joomla joomla\\!", "fixed": ["4.2.8"], "affected": ">= 4.0.0, < 4.2.8", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "joomla", "php", "runtime", "self-hosted"]
not_affected_if: ["api-disabled", "non-joomla"]
published_at: "2023-02-16T17:15:10+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:05+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-23752", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23752", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# joomla joomla\!: An issue was discovered in Joomla! 4.0.0 through 4.2.7

Joomla! has an improper access control flaw that lets unauthenticated users reach webservice API endpoints they should not see. Attackers can read data exposed through those endpoints, including user details and configuration, and the flaw is known to be actively exploited.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Joomla! Joomla! affected ? fixed ?
- vendor:joomla joomla\! affected >= 4.0.0, < 4.2.8 fixed 4.2.8

## How to check

Check the Joomla version under System > System Information; versions 4.0.0 through 4.2.7 are affected per public reports, which the sources here do not confirm.
Review web server logs for requests to /api/index.php/v1/users or /api/index.php/v1/config.

## Fix

Upgrade Joomla to a fixed release (4.2.8 or later per public reports, not confirmed by these sources).
If upgrading is not possible, block public access to /api/ at the web server or disable the Web Services API.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-23752
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2023-23752

## From the sources

Joomla! contains an improper access control vulnerability that allows unauthorized access to webservice endpoints.

CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_