CSRF Vulnerability in Joomla's User Activation Endpoint

CVE-2026-35220

What is CVE-2026-35220?

A Cross-Site Request Forgery (CSRF) vulnerability exists in the admin activation endpoint of Joomla's user management component. This vulnerability arises from inadequate validation of CSRF tokens, potentially allowing attackers to exploit this weakness. By leveraging this flaw, unauthorized actions can be executed on behalf of an authenticated user, compromising the security and integrity of affected Joomla installations. Users are encouraged to update their systems and implement security best practices to mitigate any risks associated with this vulnerability.

References