{"id":"CVE-2026-115451","kind":"vulnerability","aliases":["CVE-2026-115451"],"related":[],"title":"Joomla Advanced Custom Fields extension lets anyone delete gallery images","description":"Joomla Extension - tassos.gr - File deletion through improper access control in Advanced Custom Fields extension 2.8.13-2.8.15, 3.1.4-3.1.8 and Smile Pack 1.2.7-1.2.9, 2.1.2-2.1.6 - Anyone could delete images in the Gallery folders, including images on published articles and modules, without logging in. In ACF 3.1.7 and 3.1.8, users could also see, remove or save each other’s unsaved uploads.","summary":"The tassos.gr Advanced Custom Fields extension for Joomla has an improper access control flaw that lets anyone delete images in its Gallery folders. In versions 3.1.7 and 3.1.8 users could also view, remove or save each other's unsaved uploads.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["advanced-custom-fields","joomla","runtime","self-hosted","smile-pack","tassos.gr"],"not_affected_if":["not-installed","unaffected-version"],"how_to_check":"- Check the installed version of the Advanced Custom Fields extension in the Joomla administrator under Extensions > Manage.\n- Check whether Smile Pack is installed and its version, since it is also listed as affected.","fix":"- Advanced Custom Fields: fixed version unknown from the sources; affected ranges are `2.8.13-2.8.15` and `3.1.4-3.1.8`.\n- Smile Pack: fixed version unknown from the sources; affected ranges are `1.2.7-1.2.9` and `2.1.2-2.1.6`.","status":"open","published_at":"2026-11-05T19:17:09+00:00","first_seen_at":"2026-11-05T19:40:35+00:00","triaged_at":"2026-11-05T19:43:14+00:00","updated_at":"2026-11-05T19:43:14+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-05T19:43:14Z","model":"claude-haiku-5-5","output":{"fix":"- Advanced Custom Fields: fixed version unknown from the sources; affected ranges are `2.8.13-2.8.15` and `3.1.4-3.1.8`.\n- Smile Pack: fixed version unknown from the sources; affected ranges are `1.2.7-1.2.9` and `2.1.2-2.1.6`.","reach":"internet","title":"Joomla Advanced Custom Fields extension lets anyone delete gallery images","impact":"medium","summary":"The tassos.gr Advanced Custom Fields extension for Joomla has an improper access control flaw that lets anyone delete images in its Gallery folders. In versions 3.1.7 and 3.1.8 users could also view, remove or save each other's unsaved uploads.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["joomla","tassos.gr","advanced-custom-fields","smile-pack","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Anyone can delete gallery images, including those on published articles.","analyst_note":"Confirm the fixed versions for Advanced Custom Fields and Smile Pack from the vendor page; the sources give only affected ranges.","how_to_check":"- Check the installed version of the Advanced Custom Fields extension in the Joomla administrator under Extensions > Manage.\n- Check whether Smile Pack is installed and its version, since it is also listed as affected.","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-version","not-installed"],"who_is_affected":"Sites running the Advanced Custom Fields extension or Smile Pack in the affected version ranges on Joomla. The flaw is reachable without logging in, so any public Joomla site with these extensions is exposed to image deletion, and sites on versions outside the listed ranges are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000773,"input_tokens":4295,"output_tokens":688,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115451':13A,16A '-2026':12A,15A '1.2.7':91C '1.2.9':92C '2.1.2':93C '2.1.6':94C '2.8.13':84C '2.8.15':85C '3.1.4':86C '3.1.7':55B,115C '3.1.8':57B,87C,117C 'access':41B,77C 'acf':114C 'advanc':2A,18B,32B,80C 'advanced-custom-field':17B 'also':60B,120C 'anyon':7A,46B,95C 'articl':107C 'control':42B,78C 'could':59B,96C,119C 'custom':3A,19B,33B,81C 'cve':11A,14A 'delet':8A,47B,74C,97C 'extens':5A,35B,71C,83C 'field':4A,20B,34B,82C 'file':73C 'flaw':43B 'folder':52B,102C 'galleri':9A,51B,101C 'host':25B 'imag':10A,48B,98C,104C 'improp':40B,76C 'includ':103C 'joomla':1A,21B,37B,70C 'let':6A,45B 'log':111C 'modul':109C 'pack':28B,90C 'publish':106C 'remov':62B,122C 'runtim':22B 'save':64B,124C 'see':121C 'self':24B 'self-host':23B 'smile':27B,89C 'smile-pack':26B 'tassos.gr':29B,31B,72C 'unsav':68B,128C 'upload':69B,129C 'user':58B,118C 'version':54B 'view':61B 'without':110C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Advanced Custom Fields extension or Smile Pack in the affected version ranges on Joomla. The flaw is reachable without logging in, so any public Joomla site with these extensions is exposed to image deletion, and sites on versions outside the listed ranges are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["advancedcustomfields","joomla","medium","runtime","selfhosted","smilepack","tassosgr"],"campaign_type":null,"first_public_at":"2026-11-05T19:17:09+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@joomla.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115451","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115451","severity":null,"published_at":"2026-11-05T19:17:09+00:00","modified_at":"2026-11-05T19:17:09+00:00","first_seen_at":"2026-11-05T19:40:35+00:00","fetched_at":"2026-11-05T19:40:35+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}