Executive brief
Joomla! CMS, a popular platform for building and managing websites, contains a security flaw in its task scheduling component. This vulnerability allows users with low-level administrative permissions to modify the types of existing scheduled tasks, which they should not normally be able to access. If exploited, this could allow unauthorized users to interfere with automated site maintenance or background operations, potentially impacting site stability or security configurations.
Technical details
An incorrect access control vulnerability (CWE-284) exists within the 'com_scheduler' component of Joomla! CMS. The root cause is an improper access check that fails to sufficiently validate user permissions when editing existing scheduler tasks. A remote attacker with low-level administrative privileges can exploit this over the network to change the task types of configured jobs. While the primary impact is on the integrity and availability of scheduled operations, the CVSS 4.0 score reflects a high impact on subsequent systems. The issue is resolved in Joomla! CMS versions 5.4.6 and 6.1.1.
Affected products
- Joomla! CMS 4.1.0-5.4.5, 6.0.0-6.1.0
Timeline
- 2026-04-29: disclosed: Vulnerability reported to Joomla! Project
- 2026-05-26: patched: Fixed in versions 5.4.6 and 6.1.1
- 2026-05-26: advisory: Public advisory published by Joomla! and NVD