{"vulnerability": "cve-2026-23899", "sightings": [{"uuid": "8f6cdfd7-c5c4-464a-8127-1f348d2c8ab1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-23899", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0384/", "content": "", "creation_timestamp": "2026-03-31T17:00:00.000000Z"}, {"uuid": "73b9dab9-409d-45f4-8c93-01406a2420d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-23899", "type": "seen", "source": "https://bsky.app/profile/undercode.bsky.social/post/3mj3i6n3b4g2f", "content": "", "creation_timestamp": "2026-04-09T18:53:46.680592Z"}, {"uuid": "4435bf71-2086-4c2b-a9d8-185b735c5baa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-23899", "type": "published-proof-of-concept", "source": "Telegram/or2m_3WCYby8bXskMQzpfDu1qBTJahou7yZRDnRXRdJQw8o", "content": "", "creation_timestamp": "2026-04-01T11:16:06.000000Z"}, {"uuid": "1bafcd8d-a177-41cf-934f-39c078ff8d9f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-23899", "type": "seen", "source": "https://gist.github.com/alon710/f442a5ac1ac4aafb308e2be89c0b7ee0", "content": "# CVE-2026-23899: CVE-2026-23899: Improper Access Check in Joomla! com_config Webservices\n\n> **CVSS Score:** 8.8\n> **Published:** 2026-04-01\n> **Full Report:** https://cvereports.com/reports/CVE-2026-23899\n\n## Summary\nCVE-2026-23899 is a critical authorization bypass vulnerability within the Joomla! CMS webservice API. Due to an improper access check in the com_config component, authenticated low-privileged users can read and modify the global configuration, leading to the exposure of database credentials and the application secret key.\n\n## TL;DR\nAn authorization bypass in Joomla! webservice endpoints allows authenticated low-privileged users to read and modify sensitive configuration settings, resulting in total system compromise.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-284\n- **Attack Vector**: Network\n- **Privileges Required**: Low (API Token)\n- **CVSS v3.1 Score**: 8.8\n- **EPSS Score**: 0.00001\n- **Exploit Status**: Proof of Concept\n\n## Affected Systems\n\n- Joomla! CMS\n- **Joomla! CMS**: 4.0.0 - 5.4.3 (Fixed in: `5.4.4`)\n- **Joomla! CMS**: 6.0.0 - 6.0.3 (Fixed in: `6.0.4`)\n\n## Mitigation\n\n- Upgrade Joomla! core to versions 5.4.4 or 6.0.4\n- Rotate all credentials stored in configuration.php\n- Restrict API access network-wise if not explicitly required\n\n**Remediation Steps:**\n1. Backup the current Joomla! installation and database.\n2. Apply the 5.4.4 or 6.0.4 update via the Joomla Update component.\n3. Change the database user password on the SQL server and update configuration.php accordingly.\n4. Rotate the SMTP password used for email relay.\n5. Generate a new cryptographic secret key in configuration.php to invalidate existing sessions.\n\n## References\n\n- [Joomla Developer Security Advisory](https://developer.joomla.org/security-centre/1032-20260306-core-improper-access-check-in-webservice-endpoints.html)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-23899)\n- [CyStack Technical Research](https://cystack.net/vi/research/lo-hong-joomla-rest-api)\n- [SentinelOne Vulnerability Database](https://www.sentinelone.com/vulnerability-database/cve-2026-23899/)\n- [Joomla Release Announcement](https://www.joomla.org/announcements/release-news/5944-joomla-6-0-4-5-4-4-security-bugfix-release.html)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-23899) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-05-15T15:10:29.000000Z"}, {"uuid": "bf4b0c7c-2ef5-44e7-b32c-6cab33d128fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-23899", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mignajgaym2s", "content": "", "creation_timestamp": "2026-04-01T11:58:23.466385Z"}, {"uuid": "a9f07332-ca0d-42e9-94c7-871b09bcfec3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-23899", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3migohoedj52z", "content": "", "creation_timestamp": "2026-04-01T12:20:17.850499Z"}]}