CVE-2026-76597 is an improper access control vulnerability (CWE-284) in the Fabrik extension for Joomla, specifically in the list email plugin controller. This flaw allows unauthenticated attackers to upload arbitrary non-executable files to the web root directory in Fabrik versions 1.0.0 through 4.7.1. The vulnerability enables attackers to place files on the server without authentication, potentially facilitating further attacks or unauthorized actions. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, no privileges required, no user interaction, and high impact on integrity.

The vulnerability allows unauthenticated attackers to upload arbitrary files to the web root, which can compromise the integrity of the affected system. Although the uploaded files are non-executable, the ability to place files in the web root may enable attackers to manipulate site content or conduct further attacks depending on server configuration. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented. Users should monitor the vendor's announcements for updates and avoid exposing the vulnerable plugin until a fix is available.