This vulnerability (CVE-2026-35223) in Joomla! CMS is caused by an improper access check on the com_config webservice endpoints, classified under CWE-284 (Improper Access Control). It affects multiple versions of Joomla! CMS, specifically 4.0.0 to 5.4.5 and 6.0.0 to 6.1.0. The CVSS 4.0 base score is 8.6, indicating high severity, with network attack vector, low attack complexity, no user interaction required, and high impact on confidentiality, integrity, and availability. The vulnerability allows unauthorized access despite requiring high privileges, suggesting a bypass of intended access controls. No official fix or patch has been documented in the provided data.

Successful exploitation of this vulnerability could allow unauthorized users to access or potentially modify configuration settings via the com_config webservice endpoints. This could lead to exposure of sensitive configuration data and compromise of system integrity and availability. The high CVSS score reflects the significant impact on confidentiality, integrity, and availability. However, there are no known exploits in the wild currently.

Patch status is not yet confirmed — check the Joomla! Project vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected endpoints where possible and monitor for unusual activity related to configuration access. Do not assume the vulnerability is mitigated without vendor confirmation.