Joomla! CMS versions 4.0.0 to 5.4.7 and 6.0.0 to 6.1.2 contain an improper implementation of CORS origin validation. This improper validation prevents configured CORS origins from being properly checked in CORS requests, potentially allowing unauthorized cross-origin interactions. The vulnerability is identified as CWE-93, which involves improper neutralization of CRLF sequences (CRLF Injection). No known exploits in the wild have been reported. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with low confidentiality, integrity, and availability impact but some scope and security impact.

The improper CORS origin validation could allow attackers to bypass same-origin policy restrictions, potentially enabling unauthorized cross-origin requests. This may lead to information disclosure or other security issues depending on the context of the CORS usage. However, no active exploitation has been reported, and the impact is limited to the affected Joomla! CMS versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided in the input data, users should monitor Joomla! Project advisories for updates. Until a fix is available, consider restricting CORS configurations and reviewing CORS policies to minimize exposure.