Joomla! Project Joomla! CMS: critical vulnerability

Joomla! Project Joomla! CMS

An improper access check allows unauthorized access to com_config webservice endpoints.

Fix it

Joomla! CMS

On 5.xUpgrade to Joomla! CMS 5.4.6
On 6.xUpgrade to Joomla! CMS 6.1.1
On 4.xNo fix on 4.x yet

First seen: 28 Oct 2026
Last update: 28 Oct 2026, 16:18 UTC
Fixed in: 6.1.1
5.4.6
Identifiers: CVE-2026-35223
CVSS: 9.8
Source: news
On the menu as: Drupal / Joomla

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Joomla! Project Joomla! CMS: critical vulnerability
Severity: critical. Patch status: patched.
Affected: Joomla! Project Joomla! CMS
Fixed in: 6.1.1, 5.4.6
Ids: CVE-2026-35223

An improper access check allows unauthorized access to com_config webservice endpoints.

## Steps
1. Search the repo, its CI and infra config for Joomla! Project Joomla! CMS. If present, report the version in use and whether it's affected.
2. Fix by release line: Joomla! CMS: 6.0.x → 6.1.1; 5.4.6; 4.0.x → no fix on 4.x yet.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| Joomla! CMS 6.0.x | fixed | 6.1.1 | — |
| Joomla! CMS | fixed | 5.4.6 | — |
| Joomla! CMS 4.0.x | migrate | move to 5.4.6 | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-35223") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://developer.joomla.org/security-centre/1040-20260508-core-improper-access-check-in-com-config-webservice-endpoints.html https://nvd.nist.gov/vuln/detail/CVE-2026-35223
https://pwned.coffee/i/an-improper-access-check-allows-unauthorized-access-to-c-cve-2026-35223

Timeline

28 Oct 2026, 16:18 UTC
Fix status: unknown → patched.
28 Oct 2026
First reported.

Receipt

Exploitation: No known exploitation
Fix by release line: Product Affected Fixed in Source
Joomla! CMS 6.0.0 to before 6.1.1 6.1.1 NVD checked 28 Oct
Joomla! CMS before 5.4.6 5.4.6 NVD checked 28 Oct
Joomla! CMS = 4.0.0-5.4.5 no fix on 4.x yet CVE record (CNA) checked 28 Oct
Score: CVSS 9.8 (critical). CVSS 3.1 9.8 (NVD) for CVE-2026-35223
Last checked: 28 Oct 2026, 16:18 UTC

Product	Affected	Fixed in	Source
Joomla! CMS	6.0.0 to before 6.1.1	6.1.1	NVD checked 28 Oct
Joomla! CMS	before 5.4.6	5.4.6	NVD checked 28 Oct
Joomla! CMS	= 4.0.0-5.4.5	no fix on 4.x yet	CVE record (CNA) checked 28 Oct

Sources: KEV – CVE record ✓ Vendor ✓

Sources

Wrong fix version, or a source we missed? Send it back to chef@pwned.coffee with the source, and we'll correct it here.

Totalone very hot coffee