# CVE-2026-92226: Joomla Core improper ACL checks in webservice edit tasks

Source: https://junglewise.ai/threats/cve-2026-92226-joomla-core-20260913-core-improper-acl-checks-for-varous  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-29. Updated: 2026-09-29  
License: CC BY 4.0 with a link back

CVE-2026-92226 · Severity: info · Published 2026-09-29

Joomla is a widely-used content management system for building websites and online applications. A flaw in access control checks allows unauthorized users to edit items they should not have permission to modify, potentially leading to unauthorized content changes or data manipulation on affected websites.

Technologies: [Joomla! Joomla CMS](https://junglewise.ai/threats/technologies/joomla-joomla-cms-1). Vendors: [Joomla!](https://junglewise.ai/threats/vendors/joomla).

## Quick answers

**Is CVE-2026-92226 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92226 being exploited in the wild.

**How severe is CVE-2026-92226?** Informational severity, published 29 September 2026.

**Which products and versions are affected?** Joomla! Joomla CMS 4.0.0-5.4.8, 6.0.0-6.1.3.

**Is there a fix for CVE-2026-92226?** A patch was published on 2026-09-25. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-92226 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-92226?** Check whether you run Joomla! Joomla CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an improper access control issue in the webservice edit functionality of Joomla Core. Unauthorized users can bypass ACL (Access Control List) checks to perform edit actions on otherwise uneditable items. The flaw affects Joomla versions 4.0.0–5.4.8 and 6.0.0–6.1.3, and has been fixed in versions 5.4.9 and 6.1.4.

## Affected products

- Joomla Joomla CMS 4.0.0-5.4.8, 6.0.0-6.1.3

## Timeline

- 2026-09-29: disclosed
- 2026-09-25: patched

## References

- [https://developer.joomla.org/security-centre/1093-20260913-core-improper-acl-checks-for-varous-webservice-edit-tasks.html](https://developer.joomla.org/security-centre/1093-20260913-core-improper-acl-checks-for-varous-webservice-edit-tasks.html)
- [https://www.joomla.org/](https://www.joomla.org/)

## Related threats

- [Joomla Core improper ACL checks in tagged items](https://junglewise.ai/threats/cve-2026-90917-joomla-core-20260907-core-improper-acl-checks-in-outputs-for)
- [Joomla CMS improper ACL checks in content history comparison](https://junglewise.ai/threats/cve-2026-90916-joomla-core-20260906-core-improper-acl-checks-in-content-history)
- [Joomla Core arbitrary directory deletion via cache purge](https://junglewise.ai/threats/cve-2026-90915-joomla-core-20260905-core-arbitrary-directory-deletion-via-cache)