This vulnerability involves inconsistent access control checks in Joomla! CMS webservice endpoints for mutating actions. Specifically, mutation operations that are restricted in the backend user interface are improperly accessible through webservice endpoints, allowing unauthorized users with high privileges to perform these actions. The affected versions include Joomla! 4.0.0 up to 5.4.6 and 6.0.0 up to 6.1.2. The CVSS 4.0 score is 8.5, indicating a high severity issue with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity.

Unauthorized users can perform mutation actions on Joomla! CMS webservice endpoints that should be restricted, potentially leading to unauthorized modifications of the system. The vulnerability affects confidentiality and integrity with high impact, but requires high privileges to exploit.

No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the Joomla! Project vendor advisory for current remediation guidance. Until a fix is available, restrict access to webservice endpoints and monitor for unauthorized mutation attempts.