The Joomdle component for Joomla, versions 0.7.0 up to 3.0.1, contains a vulnerability due to insecure default configuration settings. This flaw permits unauthenticated attackers to read user account information and reset passwords, effectively granting unauthorized read/write access to CMS accounts. The vulnerability is tracked as CVE-2026-65881 and is classified under CWE-1188 and CWE-200. The CVSS v3.1 base score is 7.5, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact. No official patch or remediation guidance is currently documented by the vendor.

Exploitation of this vulnerability allows attackers to gain unauthorized read and write access to Joomla CMS user accounts, including the ability to reset passwords. This compromises the confidentiality of user data and potentially allows account takeover. There is no reported impact on system integrity or availability. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should review and harden the configuration settings of the Joomdle component to disable insecure defaults that allow unauthorized access. Monitoring for updates from the vendor is strongly recommended.