---
id: "CVE-2026-115451"
kind: "vulnerability"
aliases: ["CVE-2026-115451"]
title: "Joomla Advanced Custom Fields extension lets anyone delete gallery images"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["advanced-custom-fields", "joomla", "runtime", "self-hosted", "smile-pack", "tassos.gr"]
not_affected_if: ["not-installed", "unaffected-version"]
published_at: "2026-11-05T19:17:09+00:00"
first_seen_at: "2026-11-05T19:40:35+00:00"
updated_at: "2026-11-05T19:43:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115451", "first_seen_at": "2026-11-05T19:40:35+00:00"}]
exploit_sources: []
---

# Joomla Advanced Custom Fields extension lets anyone delete gallery images

The tassos.gr Advanced Custom Fields extension for Joomla has an improper access control flaw that lets anyone delete images in its Gallery folders. In versions 3.1.7 and 3.1.8 users could also view, remove or save each other's unsaved uploads.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Advanced Custom Fields extension in the Joomla administrator under Extensions > Manage.
- Check whether Smile Pack is installed and its version, since it is also listed as affected.

## Fix

- Advanced Custom Fields: fixed version unknown from the sources; affected ranges are `2.8.13-2.8.15` and `3.1.4-3.1.8`.
- Smile Pack: fixed version unknown from the sources; affected ranges are `1.2.7-1.2.9` and `2.1.2-2.1.6`.

## Timeline

- 2026-11-05T19:40:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115451

## From the sources

Joomla Extension - tassos.gr - File deletion through improper access control in Advanced Custom Fields extension 2.8.13-2.8.15, 3.1.4-3.1.8 and Smile Pack 1.2.7-1.2.9, 2.1.2-2.1.6 - Anyone could delete images in the Gallery folders, including images on published articles and modules, without logging in. In ACF 3.1.7 and 3.1.8, users could also see, remove or save each other’s unsaved uploads.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_