# CVE-2016-9081: Joomla! CMS account modification and password reset vulnerability

Source: https://junglewise.ai/threats/cve-2016-9081-joomla-cms-account-modification-and-password-reset-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-23. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2016-9081 · Severity: critical · CVSS 9.8 · Published 2017-01-23

Joomla!, a popular website management platform, contains a critical security flaw that allows unauthorized individuals to take over user accounts. An attacker can remotely reset usernames, passwords, and administrative permissions for any existing account. This could lead to a complete website takeover, loss of sensitive data, and unauthorized changes to site content.

Technologies: [Joomla! Joomla\!](https://junglewise.ai/threats/technologies/joomla). Vendors: [Joomla!](https://junglewise.ai/threats/vendors/joomla).

## Quick answers

**Is CVE-2016-9081 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-9081 being exploited in the wild.

**How severe is CVE-2016-9081?** Critical severity, with a CVSS score of 9.8, published 23 January 2017.

**Which products and versions are affected?** Joomla! Joomla\! 3.4.4 through 3.6.3.

**Is there a fix for CVE-2016-9081?** A patch was published on 2016-10-25: Fixed in version 3.6.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2016-9081 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2016-9081?** Check whether you run Joomla! Joomla\! at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability in Joomla! CMS versions 3.4.4 through 3.6.3 stems from the incorrect use of unfiltered data during account management processes. This flaw allows a remote, unauthenticated attacker to modify existing user accounts via unspecified vectors. Specifically, an attacker can reset account credentials (username and password) and elevate privileges by modifying user group assignments. The issue is categorized under Credentials Management Errors (CWE-255). A patch is available in Joomla! version 3.6.4.

## Affected products

- Joomla! Joomla! CMS 3.4.4 through 3.6.3

## Timeline

- 2016-10-25: patched: Fixed in version 3.6.4
- 2016-10-26: disclosed: Reported to the Joomla! Security Strike Team
- 2017-01-23: advisory: NVD publication date

## References

- [http://www.securityfocus.com/bid/93969](http://www.securityfocus.com/bid/93969)
- [https://developer.joomla.org/security-centre/661-20161003-core-account-modifications.html](https://developer.joomla.org/security-centre/661-20161003-core-account-modifications.html)

## Related threats

- [Joomla Core XSS filter bypass in InputFilter with whitespace data URIs](https://junglewise.ai/threats/cve-2026-92232-joomla-core-20260916-core-xss-filter-bypass-in-inputfilter-via)
- [Joomla Core XSS filter bypass in InputFilter via HTML5 entity decode](https://junglewise.ai/threats/cve-2026-92231-joomla-core-20260915-core-xss-filter-bypass-in-inputfilter-via)
- [Joomla Core XSS in module list](https://junglewise.ai/threats/cve-2026-92225-joomla-core-20260912-core-xss-in-module-list-in-joomla-4-0-0-5-4)
- [Joomla Core improper ACL checks for workflow stage changes](https://junglewise.ai/threats/cve-2026-92223-joomla-core-20260910-core-improper-acl-checks-for-workflow-stage)
- [Joomla Core stored XSS in HTML mail templates](https://junglewise.ai/threats/cve-2026-90918-joomla-core-20260908-core-xss-in-html-mail-templates-in-joomla-4)