Improper Access Control in Joomla Extension by tassos.gr
CVE-2026-115451

6.9MEDIUM

Key Information:

Vendor

Tassos.gr

Status
Advanced Custom Fields Extension For Joomla
Smile Pack Extension For Joomla
Vendor
CVE Published:
5 November 2026

What is CVE-2026-115451?

The Joomla Extension by tassos.gr contains an improper access control vulnerability that allows unauthorized users to delete images from Gallery folders, which includes publicly accessible images on articles and modules. Users are not required to log in to perform deletions. Additionally, versions 3.1.7 and 3.1.8 of the Advanced Custom Fields extension allow users to view, remove, or save other users' unsaved uploads, posing a significant risk to user data integrity.

Affected Version(s)

Advanced Custom Fields extension for Joomla 3.1.4-3.1.8

Advanced Custom Fields extension for Joomla 2.8.13-2.8.15

Smile Pack extension for Joomla 2.1.2-2.1.6

References

https://www.tassos.gr/
product

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Michael Nielsen
.