{"id":"CVE-2026-120333","kind":"vulnerability","aliases":["CVE-2026-120333"],"related":[],"title":"Joomla extension: email confirmation links delete accounts without valid hash","description":"The actions linked in the emails of the extension (e.g. to confirm a registration or the deletion of an account) do not reject requests with a missing or invalid hash. Instead, the frontend user given in the request is used. Unauthenticated attackers can therefore perform these actions for arbitrary active frontend users. This allows them to retrieve the email address or username of all frontend users and to delete arbitrary frontend user accounts.","summary":"The actions linked in the extension's emails, such as confirming a registration or deleting an account, accept requests without a valid hash and use the frontend user named in the request. An unauthenticated attacker can therefore delete arbitrary active frontend user accounts and retrieve their email addresses or usernames.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["joomla","other","self-hosted","user-accounts"],"not_affected_if":["extension-not-installed","no-frontend-users"],"how_to_check":"Unknown: extension not yet named. Check the NVD record's references for the extension name; then see whether it is installed under Joomla Administrator > System > Manage > Extensions.","fix":null,"status":"open","published_at":"2026-11-03T10:17:18+00:00","first_seen_at":"2026-11-03T10:20:16+00:00","triaged_at":"2026-11-03T10:20:31+00:00","updated_at":"2026-11-03T10:21:46+00:00","category":"other","confidence":0.3,"triage":{"at":"2026-11-03T10:20:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Joomla extension: email confirmation links delete accounts without valid hash","impact":"medium","summary":"The actions linked in the extension's emails, such as confirming a registration or deleting an account, accept requests without a valid hash and use the frontend user named in the request. An unauthenticated attacker can therefore delete arbitrary active frontend user accounts and retrieve their email addresses or usernames.","audience":"businesses","category":"other","nicknames":[],"who_cares":["joomla","self-hosted","user-accounts"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker deletes user accounts and reads user emails and usernames","analyst_note":"Identify the extension name, affected and fixed versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-120333 and the vendor advisory.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["extension-not-installed"],"who_is_affected":"The sources do not name the extension or its versions, so the exact exposure is unknown. Sites running the affected extension with frontend user registration and account actions triggered from emails are the likely target. unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00065,"input_tokens":4139,"output_tokens":473,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the extension name, affected and fixed versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-120333 and the vendor advisory.","search":"'-120333':13A,16A '-2026':12A,15A 'accept':42B 'account':7A,24B,41B,67B,94C,147C 'action':26B,76C,121C 'activ':64B,124C 'address':72B,134C 'allow':128C 'arbitrari':63B,123C,144C 'attack':59B,116C 'confirm':4A,35B,86C 'cve':11A,14A 'delet':6A,39B,62B,91C,143C 'e.g':84C 'email':3A,32B,71B,80C,133C 'extens':2A,30B,83C 'frontend':51B,65B,107C,125C,139C,145C 'given':109C 'hash':10A,47B,104C 'host':21B 'instead':105C 'invalid':103C 'joomla':1A,17B 'link':5A,27B,77C 'miss':101C 'name':53B 'perform':119C 'registr':37B,88C 'reject':97C 'request':43B,56B,98C,112C 'retriev':69B,131C 'self':20B 'self-host':19B 'therefor':61B,118C 'unauthent':58B,115C 'use':49B,114C 'user':23B,52B,66B,108C,126C,140C,146C 'user-account':22B 'usernam':74B,136C 'valid':9A,46B 'without':8A,44B","nicknames":[],"mitigations":[],"who_affected":"The sources do not name the extension or its versions, so the exact exposure is unknown. Sites running the affected extension with frontend user registration and account actions triggered from emails are the likely target. unknown","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","joomla","other","selfhosted","useraccounts"],"first_public_at":"2026-11-03T10:17:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"f4fb688c-4412-4426-b4b8-421ecf27b14a","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120333","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120333","severity":null,"published_at":"2026-11-03T10:17:18+00:00","modified_at":"2026-11-03T10:17:18+00:00","first_seen_at":"2026-11-03T10:20:16+00:00","fetched_at":"2026-11-03T10:20:16+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120333:1479","url":null,"severity":null,"published_at":"2026-11-03T10:21:46+00:00","modified_at":"2026-11-03T10:21:46+00:00","first_seen_at":"2026-11-03T10:21:46+00:00","fetched_at":"2026-11-03T10:21:46+00:00","note":"NVD page returned no text and web searches (Joomla Security Centre, mysites.guru, joomguard, general) did not name the extension, affected or fixed versions for this CVE; too new (published 2026-11-03). No primary source read, nothing verified. Settle by reading the NVD/CVE.org record references or the extension developer's changelog; revisit later. Who is affected: Joomla sites running a third-party extension that emails frontend users confirmation links; extension not yet named; sites without it or without frontend users can skip."}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}