The K2 extension for Joomla contains a missing authorization vulnerability (CWE-862) in its frontend 'item.checkin' task. An unauthenticated attacker can supply a 'sigProFolder' query parameter that is directly passed to a JFolder::delete() function call, allowing deletion of folders under /media/k2/galleries/. This could lead to unauthorized deletion of media files. The issue affects versions =1.0-2.26. There is no CVSS score or vendor advisory indicating a patch or fix at this time.

An unauthenticated attacker can delete folders under the /media/k2/galleries/ directory by exploiting the lack of authorization checks on the 'sigProFolder' parameter. This could result in loss of media content managed by the K2 extension, potentially disrupting website functionality or causing data loss. There is no indication of remote code execution or privilege escalation beyond unauthorized deletion.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoint if possible and monitor for suspicious requests targeting the 'sigProFolder' parameter. Avoid exposing the vulnerable functionality to unauthenticated users.