The K2 extension for Joomla contains a missing authorization vulnerability (CWE-862) in its frontend 'item.checkin' task. Specifically, the 'sigProFolder' query parameter is accepted without authentication and is directly passed to the JFolder::delete() function targeting directories under '/media/k2/galleries/'. This lack of access control could enable unauthenticated attackers to delete arbitrary folders within that path. The affected versions are from 1.0 up to 2.26. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

An unauthenticated attacker can delete folders under the '/media/k2/galleries/' directory on a Joomla site running the vulnerable K2 extension versions. This could lead to loss of media content managed by K2 galleries, impacting data integrity and availability. The CVSS v3.1 base score is 6.5 (medium), reflecting network attack vector, low complexity, no privileges or user interaction required, with limited confidentiality and integrity impact and no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected Joomla extension or disable the vulnerable functionality if possible. Monitor for updates from the K2 extension maintainers or Joomla security announcements.