This vulnerability (CVE-2026-35220) affects Joomla! CMS versions 6.0.0 through 6.1.0. It arises from missing CSRF token validation in the administrative activation endpoint of the com_users component, enabling a cross-site request forgery (CWE-352) attack vector. The CVSS 4.0 base score is 4.6 (medium severity), reflecting network attack vector, low attack complexity, no privileges required but user interaction needed, and limited impact on integrity. No known exploits are reported in the wild. There is no vendor advisory or patch information available at this time.

The vulnerability allows an attacker to potentially perform unauthorized actions on behalf of an authenticated administrator by exploiting the lack of CSRF token validation in the admin activation endpoint. However, exploitation requires the attacker to have high privileges and the victim's interaction, limiting the overall impact. The integrity of the system could be partially compromised, but confidentiality and availability are not affected according to the CVSS vector.

Patch status is not yet confirmed — check the Joomla! Project vendor advisory for current remediation guidance. Until an official fix is released, administrators should be cautious with user interactions and consider implementing additional CSRF protections or access restrictions on the affected endpoint if possible.