CVE-2026-76571: CWE-89: Improper Neutralization of Special Elements used in an SQL Command in fabrikar.com Fabrik extension for Joomla

CVE-2026-76571 is an SQL injection vulnerability in the Fabrik extension for Joomla (versions up to and including 4.7.3). The issue arises from improper neutralization of special elements in the condition parameter used in list filters. This parameter is concatenated verbatim into the SQL WHERE clause constructed by the getFilterQuery() function. Because the injection point is unauthenticated, an attacker can supply arbitrary SQL code, enabling full read access to the database. The vulnerability is classified under CWE-89 and has a critical CVSS 4.0 score of 9.3. No vendor advisory or patch is currently available, and no known exploits are reported in the wild.

An unauthenticated attacker can exploit this vulnerability to perform SQL injection attacks against the Fabrik extension's database. This can lead to unauthorized disclosure of sensitive information by reading the entire database. The vulnerability does not require authentication or user interaction, increasing its risk. There is no indication of privilege escalation or remote code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable list filter functionality to prevent exploitation. Monitor official Fabrik and Joomla channels for updates and apply patches promptly once available.