CVE-2026-21629
Published: 01 April 2026
Summary
CVE-2026-21629 is a high-severity Improper Access Control (CWE-284) vulnerability in Joomla Joomla\!. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 0.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces approved authorizations for logical access to system resources, directly preventing unauthorized access to administrative AJAX endpoints due to the missing logged-in-user check.
Identifies and explicitly authorizes specific actions performable without identification or authentication, addressing the unexpected exclusion of the AJAX component from login checks.
Employs least privilege to restrict access to only necessary functions for authorized users, mitigating unauthorized invocation of administrative AJAX functionality.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unauthenticated remote exploitation of improper access control in a public-facing web application (Joomla admin ajax component) to bypass authentication checks.
NVD Description
The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party developers.
Deeper analysisAI
CVE-2026-21629 is an improper access control vulnerability (CWE-284) in the Joomla CMS core, specifically affecting the ajax component in the administrative area. This component was excluded from the default logged-in-user check, a behavior that was potentially unexpected by third-party developers. The issue carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and was published on 2026-04-01.
Unauthenticated attackers can exploit this vulnerability remotely over the network with low complexity and no user interaction required. By bypassing the logged-in-user check, they may access certain administrative ajax endpoints, potentially leading to low-level impacts on confidentiality, integrity, and availability, depending on the specific ajax functionality invoked.
The official Joomla security advisory (https://developer.joomla.org/security-centre/1027-20260301-core-acl-hardening-in-com-ajax.html) addresses mitigation through core ACL hardening in the com_ajax component, recommending administrators apply the relevant Joomla updates to enforce proper access controls.
Details
- CWE(s)