The vulnerability in the Articles Anywhere extension for Joomla involves improper access control (CWE-284). Specifically, content tags can leverage ignore flags or property overrides to render articles or modules that are restricted or unpublished. This flaw permits content authors to expose content to visitors who do not have the required access permissions, violating intended access restrictions. The affected versions are from 1.0.0 through 18.0.2. No CVSS score or official remediation level is provided, and no patch links are available at this time.

Unauthorized users may view restricted or unpublished content that should be inaccessible, potentially leading to information disclosure. The impact is limited to content exposure and does not indicate further compromise such as code execution or privilege escalation. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict content author permissions to trusted users only and review published content for unintended exposure. Monitor the vendor's communications for updates on patches or official mitigations.