CVE-2026-76570 is a critical (CVSS 9.1) unauthenticated SQL injection in JCTables, a Joomla extension from JoomCode. The front-end API checks no token or login and builds queries from request values. Update JCTables to 1.21.1 or later, and check your logs for requests to the component.
What's affected
- Product: JCTables (com_jctables), a Joomla data-table extension by JoomCode.
- Affected: per VulnCheck, every release up to the 1.10.31.2 Free build it tested, since the front-end controller never had a token or access check.
- Fixed: 1.21.1, released 2026-08-05 according to VulnCheck. The NVD text names 1.21.1 in its title, so confirm the exact fixed build on the JoomCode site.
- Weakness: CWE-89, SQL injection.
- CVSS 9.1 (critical), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. Not listed in CISA KEV.
How to check if you're exposed
In the Joomla administrator, open System, then Extensions, then Manage, and search for JCTables to see the installed version. On the server, you can also confirm whether the component exists.
ls /var/www/html/components | grep -i jctables
Then look for traffic to the component's entry point in web logs.
grep -h "option=com_jctables" /var/log/nginx/access.log* | head
Adjust the paths for your server. Requests from clients you do not recognize, especially with unusual parameter values or in bulk, deserve a closer look.
What to do now
- Update JCTables to 1.21.1 or later from the JoomCode site, then confirm the version in the Joomla extension manager.
- If you cannot update today, unpublish or disable the component, or block its front-end URL at the web server.
- Review access logs for requests to
option=com_jctablesfrom unknown clients. - Check the database for unexpected new users, changed rows or new admin accounts, and rotate Joomla admin and database passwords if anything looks wrong.
- Run a web scan against a staging copy to confirm the endpoint no longer behaves unexpectedly.
Why it matters
The record is short and exact. The front-end CRUD API controller performs no Joomla token validation and no authentication check on any task. Table names, column names and values come from request parameters and go straight into SQL. That is missing authorization plus SQL injection, in a component whose job is to read and write rows.
VulnCheck says the injection can read and write, and that it chains to code execution as the web user. Joomla extensions are a frequent source of this kind of bug, because they run with the privileges of the site and get far less review than core.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to be logged in to be hit?
The record says the controller has no authentication check, so no login is needed.
Which version should I install?
Install 1.21.1 or later and confirm with JoomCode.
Sources
Last reviewed: 19 October 2026.
