CVE-2026-71573 is a high severity (CVSS 8.3) flaw in Joomla core: configured CORS origins were not properly validated. It affects 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2. Update Joomla to a current release and confirm the exact fixed version in the Joomla security announcement.
What's affected
Joomla 4.0.0 through 5.4.7, and 6.0.0 through 6.1.2, per the record's quote of the Joomla security announcement 20260802. The announcement says an improper implementation prevented configured CORS origins from being properly validated in CORS requests.
I could not read the announcement page itself, which returned a not found error when I tried, so I cannot confirm the first fixed version for each line. The Joomla home page I did fetch mentions a Joomla 6.2 release on 13 October 2026 and a 5.4.10 bugfix release, but it does not state that those releases fix this CVE. Check the Joomla security centre.
The record lists CWE-93, CRLF injection, as the weakness, which does not obviously match the CORS description. Treat the CWE as a classification from the record and read the announcement for details. The vector is AV:N/AC:L/PR:N/UI:N/S:C with low impacts in each area.
How to check if you're exposed
Find the Joomla version in the administrator panel under System, or read it from the file libraries/src/Version.php on the server. Versions from 4.0.0 to 5.4.7 and 6.0.0 to 6.1.2 are in range.
Then check whether CORS is configured. In the Global Configuration, the Web Services settings include an option to enable CORS and to set allowed origins. If CORS is off, the flaw's conditions are not met, but update anyway.
If CORS is on, review the allowed origins list. Remove any origin you do not control, and avoid wildcard values.
free in-browser dependency scan checks Composer and package manifests for known vulnerable components, which is useful for extensions.
What to do now
- Read your Joomla version from the administrator panel.
- Open the Joomla security announcement 20260802 and note the fixed version for your line.
- Update Joomla through the built-in updater, after a backup.
- Check the CORS settings and reduce allowed origins to the ones you control.
- Update extensions, since they are a larger source of Joomla vulnerabilities than core.
Why it matters
CORS is the mechanism that lets a browser page on one origin read responses from another. A server lists the origins it trusts, and the browser enforces it. If the server does not check the origin properly, it may approve sites the owner never listed, and a script on those sites could read data using the visitor's session.
The record notes a changed scope, which fits this: the harm lands in the visitor's browser session, not just on the Joomla server. CORS settings are easy to set once and forget, so review them whenever you patch.
Quick check
What is the fixed Joomla version?
I could not confirm it. The announcement page returned a not found error when I fetched it. Check the Joomla security centre entry 20260802 for the release for your 4.x, 5.x or 6.x line.
Sources
Last reviewed: 18 October 2026.
