CVE-2026-56290 is a critical improper access control vulnerability in the JoomlaCK.fr Page Builder CK extension for Joomla. It allows unauthenticated arbitrary file uploads, including executable files, leading to full remote code execution on affected systems. The vulnerability affects versions from 1.0 up to and including 3.6.0. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported as of the publication date.

Successful exploitation of this vulnerability allows an unauthenticated attacker to upload and execute arbitrary code on the server hosting the vulnerable Joomla extension. This can lead to complete system compromise, data theft, defacement, or further attacks within the network. The CVSS 4.0 base score is 10, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the JoomlaCK.fr Page Builder CK extension and consider disabling or removing the extension if possible. Monitor official channels from joomlack.fr for updates or patches addressing this vulnerability.