---
id: "CVE-2026-120333"
kind: "vulnerability"
aliases: ["CVE-2026-120333"]
title: "Joomla extension: email confirmation links delete accounts without valid hash"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["joomla", "other", "self-hosted", "user-accounts"]
not_affected_if: ["extension-not-installed", "no-frontend-users"]
published_at: "2026-11-03T10:17:18+00:00"
first_seen_at: "2026-11-03T10:20:16+00:00"
updated_at: "2026-11-03T10:21:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120333", "first_seen_at": "2026-11-03T10:20:16+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T10:21:46+00:00"}]
---

# Joomla extension: email confirmation links delete accounts without valid hash

The actions linked in the extension's emails, such as confirming a registration or deleting an account, accept requests without a valid hash and use the frontend user named in the request. An unauthenticated attacker can therefore delete arbitrary active frontend user accounts and retrieve their email addresses or usernames.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Unknown: extension not yet named. Check the NVD record's references for the extension name; then see whether it is installed under Joomla Administrator > System > Manage > Extensions.

## Timeline

- 2026-11-03T10:20:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120333
- 2026-11-03T10:21:46+00:00 analyst — NVD page returned no text and web searches (Joomla Security Centre, mysites.guru, joomguard, general) did not name the extension, affected or fixed versions for this CVE; too new (published 2026-11-03). No primary source read, nothing verified. Settle by reading the NVD/CVE.org record references or the extension developer's changelog; revisit later. Who is affected: Joomla sites running a third-party extension that emails frontend users confirmation links; extension not yet named; sites without it or without frontend users can skip.

## From the sources

The actions linked in the emails of the extension (e.g. to confirm a registration or the deletion of an account) do not reject requests with a missing or invalid hash. Instead, the frontend user given in the request is used. Unauthenticated attackers can therefore perform these actions for arbitrary active frontend users. This allows them to retrieve the email address or username of all frontend users and to delete arbitrary frontend user accounts.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_