# CVE-2026-21629: The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was…

Source: https://junglewise.ai/threats/cve-2026-21629-the-ajax-component-was-excluded-from-the-default-logged-in-user  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-01  
License: CC BY 4.0 with a link back

CVE-2026-21629 · Severity: high · CVSS 7.3 · Published 2026-04-01

The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party developers.

Technologies: [Joomla! Joomla\!](https://junglewise.ai/threats/technologies/joomla). Vendors: [Joomla!](https://junglewise.ai/threats/vendors/joomla).

## Quick answers

**Is CVE-2026-21629 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-21629 being exploited in the wild.

**How severe is CVE-2026-21629?** High severity, with a CVSS score of 7.3, published 1 April 2026.

**Which products and versions are affected?** Joomla! Joomla\!. The advisory does not name versions.

**Is there a fix for CVE-2026-21629?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2026-21629?** Check whether you run Joomla! Joomla\!. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Joomla! Joomla\!

## Related threats

- [Joomla Core XSS filter bypass in InputFilter with whitespace data URIs](https://junglewise.ai/threats/cve-2026-92232-joomla-core-20260916-core-xss-filter-bypass-in-inputfilter-via)
- [Joomla Core XSS filter bypass in InputFilter via HTML5 entity decode](https://junglewise.ai/threats/cve-2026-92231-joomla-core-20260915-core-xss-filter-bypass-in-inputfilter-via)
- [Joomla Core XSS in module list](https://junglewise.ai/threats/cve-2026-92225-joomla-core-20260912-core-xss-in-module-list-in-joomla-4-0-0-5-4)
- [Joomla Core improper ACL checks for workflow stage changes](https://junglewise.ai/threats/cve-2026-92223-joomla-core-20260910-core-improper-acl-checks-for-workflow-stage)
- [Joomla Core stored XSS in HTML mail templates](https://junglewise.ai/threats/cve-2026-90918-joomla-core-20260908-core-xss-in-html-mail-templates-in-joomla-4)