CVE-2026-60030 describes an improper access control vulnerability (CWE-284) in the themexpert.com Quix Page Builder Pro extension for Joomla. Versions from 1.0 up to 6.2.0 are affected. The vulnerability permits authenticated users to bypass media management permissions and upload media files regardless of their assigned rights. This could lead to unauthorized content being uploaded within the Joomla environment. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality. No official fix or patch has been documented as of the published date.

Authenticated users can upload media files without proper authorization, potentially allowing unauthorized content insertion or manipulation within the Joomla site. This improper access control could lead to content integrity issues or facilitate further attacks depending on the uploaded content. The vulnerability does not require elevated privileges or user interaction, increasing its risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict authenticated user permissions carefully and monitor user activities related to media uploads. Avoid granting media management permissions broadly and consider disabling or limiting the use of the Quix Page Builder Pro extension if possible.