Unauthenticated Tag Modifications in Joomla Extension by YOOtheme
CVE-2026-76610

6.9MEDIUM

Key Information:

Vendor

Yootheme.com

Status
Zoo Extension For Joomla
Vendor
CVE Published:
20 August 2026

What is CVE-2026-76610?

A significant security flaw exists in the YOOtheme Joomla Extension, Zoo, affecting versions prior to 4.1.65. The comment controller endpoint lacks proper access control list (ACL) checks, enabling unauthenticated users to make unauthorized modifications to tags. This exposure could lead to various security concerns, including content manipulation and unauthorized information exposure.

Affected Version(s)

Zoo extension for Joomla 1.0.0-4.1.64

References

https://www.yootheme.com/
product

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Phil Taylor, mysites.guru
.