Joomla AJAX Auth Bypass via Admin Check Exclusion
CVE-2026-21629 Published on April 1, 2026
Joomla! Core - [20260301] - ACL hardening in com_ajax
The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party developers.
Weakness Type
What is an Authorization Vulnerability?
The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVE-2026-21629 has been classified to as an Authorization vulnerability or weakness.
Products Associated with CVE-2026-21629
Want to know whenever a new CVE is published for Joomla? stack.watch will email you.
Affected Versions
Joomla! Project Joomla! CMS:- Version 3.0.0-5.4.3 is affected.
- Version 6.0.0-6.0.3 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.