This vulnerability (CWE-284) affects Joomla! CMS where improper access control checks on category webservice endpoints permit unauthorized creation of categories. The affected versions include 4.0.0 up to 5.4.6 and 6.0.0 up to 6.1.2. The CVSS 4.0 base score is 5.1, indicating a medium severity issue. The vulnerability requires the attacker to have high privileges (PR:H) but no user interaction is needed. There is no indication of an official patch or remediation level provided in the available data, nor are there known exploits in the wild.

An attacker with high privileges can bypass proper access control checks on category webservice endpoints to create categories without authorization. This could lead to unauthorized content organization or potential misuse of category structures within Joomla! CMS. The impact is limited by the requirement for high privileges, reducing the risk of exploitation by low-privileged users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, administrators should monitor Joomla! Project advisories for updates. Until a fix is available, restrict access to high-privilege accounts and carefully control who can access category webservice endpoints.