CVE-2026-35223 is an improper access check on Joomla com_config webservice endpoints, scored 9.8 (Critical) in the CVE record. Callers without authorization can reach endpoints that should be restricted. Joomla says to upgrade to version 5.4.6 or 6.1.1, depending on your major version, and the affected range starts at 4.0.0.
What's affected
- Product: Joomla! CMS, com_config webservice endpoints (the web services API)
- Affected versions: 4.0.0 to 5.4.5 and 6.0.0 to 6.1.0
- Fixed versions: 5.4.6 and 6.1.1
- Joomla's announcement: reported 2026-04-15, fixed 2026-05-26
Joomla rates its own severity Moderate with low probability, while the CVE record gives 9.8. The announcement does not say how the access check fails beyond the one line above. The CVE is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
Your Joomla version is shown under System, System Information in the administrator. You can also read it from the files:
grep -E "MAJOR_VERSION|MINOR_VERSION|PATCH_VERSION" libraries/src/Version.php
Compare the result with the affected ranges above. Joomla 5.4.6 and 6.1.1 are the fixed releases named in the project's announcement.
If you do not use the Joomla web services API, you can also check whether the API application is reachable on your site. The advisory does not list a workaround, so the upgrade is the fix.
What to do now
- Upgrade Joomla to 5.4.6 or 6.1.1.
- Take a backup before the upgrade and verify the version afterwards.
- If the web services API is not in use, restrict access to the API path at the web server until you have patched.
- Review configuration values and administrator accounts for changes you do not recognise.
Why it matters
The record files this under CWE-284, improper access control. The code that serves these endpoints did not apply the check it should have before answering. Configuration endpoints are sensitive because configuration holds settings that control the whole site.
Access control bugs are quiet. There is no crash and no error, only a response that went to someone who should not have received it. That is why logs and a version check matter more than waiting for a visible sign.
Quick check
Does the advisory name a workaround?
No. The announcement gives the upgrade as the solution. Limiting access to the API path at the web server is a sensible stopgap, not an official workaround.
Which versions are fixed?
5.4.6 and 6.1.1.
Sources
Last reviewed: 19 October 2026.
