The Fabrik extension for Joomla contains an improper access control vulnerability in the list controller's doempty endpoint. Versions prior to 4.7.2 do not enforce access control on this endpoint, allowing unauthenticated remote attackers to send a GET request that empties the target list's database table. This vulnerability is identified as CWE-284 and has a CVSS 4.0 score of 8.7, indicating high severity. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation results in unauthorized truncation of database tables associated with Fabrik lists, causing potential data loss and disruption of Joomla sites using the vulnerable extension. Since the attack requires no authentication and no user interaction, it poses a significant risk to affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint through web server or application-level controls to prevent unauthenticated requests to list.doempty. Monitor for updates from fabrikar.com or Joomla regarding patches or official mitigations.