CVE-2026-35223 is an improper access control vulnerability (CWE-284) in Joomla! CMS affecting versions 4.0.0 to 5.4.5 and 6.0.0 to 6.1.0. The flaw allows unauthorized access to the com_config webservice endpoints, potentially exposing configuration data or enabling unauthorized configuration changes. The vulnerability is rated high severity with a CVSS 4.0 score of 8.6, reflecting network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation level has been published by Joomla! Project as of the data provided. The vulnerability is not related to a cloud service and no exploits have been reported in the wild.

The vulnerability allows unauthorized access to Joomla! CMS configuration webservice endpoints, which could lead to exposure or modification of sensitive configuration settings. This may compromise the confidentiality, integrity, and availability of the affected Joomla! CMS instances. The high CVSS score (8.6) indicates a significant risk if exploited. However, there are no known active exploits reported at this time.

Patch status is not yet confirmed — check the Joomla! Project vendor advisory for current remediation guidance. Since no official fix or temporary workaround has been published, users should monitor Joomla! security advisories closely. Until a patch is available, restrict access to the com_config webservice endpoints where possible and apply principle of least privilege to user roles with access to configuration functions.