Access Control Flaw in Joomla Extension from Fabrikar
CVE-2026-77992

9.5CRITICAL

Key Information:

Vendor

Fabrikar.com

Status
Fabrik Extension For Joomla
Vendor
CVE Published:
22 August 2026

What is CVE-2026-77992?

The Fabrikar Joomla extension is susceptible to an access control vulnerability involving the onUpdateComment endpoint. This flaw allows attackers to exploit the heredoc terminator breakout in the calc element, leading to potential misuse and unauthorized actions within the application. The issue primarily affects versions prior to 4.7.2, underscoring the need for users to update their installations to safeguard against unauthorized access.

Affected Version(s)

Fabrik extension for Joomla 1.0.0-4.7.1

References

https://www.fabrikar.com/
product

CVSS V4

Score:
9.5
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Phil Taylor, mysites.guru
.