CVE-2026-76571 describes an unauthenticated SQL injection vulnerability in the Fabrik extension for Joomla. The vulnerability occurs in versions from 1.0.0 up to and including 4.7.3, where the condition parameter in a list filter is concatenated verbatim into the WHERE clause by the getFilterQuery() function. This improper neutralization of special elements in SQL commands (CWE-89) enables an attacker to supply arbitrary SQL code, resulting in full read access to the database without authentication.

An attacker can exploit this vulnerability to execute arbitrary SQL queries on the affected Joomla Fabrik extension database, leading to unauthorized disclosure of sensitive data. The vulnerability does not require authentication, increasing its severity. The CVSS 4.0 base score is 9.3 (critical), reflecting the high impact and ease of exploitation. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the Fabrik and Joomla vendor advisories for updates. Until a patch is available, consider disabling the vulnerable list filter functionality or restricting access to the affected extension to trusted users only.