CVE-2026-76597: CWE-284 Improper Access Control in fabrikar.com Fabrik extension for Joomla

The Fabrik extension for Joomla, versions up to and including 4.7.1, contains an improper access control vulnerability (CWE-284) in its list email plugin controller. This flaw permits unauthenticated users to upload arbitrary non-executable files to the web root directory. The vulnerability is identified as CVE-2026-76597 with a CVSS 4.0 base score of 8.7, indicating high severity. No official patch or remediation level has been provided in the available data, and no known exploits in the wild have been reported.

Successful exploitation allows unauthenticated attackers to upload arbitrary files to the web root, which could lead to unauthorized content placement or further attacks depending on the server configuration. Although the uploaded files are non-executable, this could still facilitate information disclosure, defacement, or indirect compromise scenarios.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the list email plugin controller and monitor for unauthorized file uploads. Avoid exposing the Fabrik extension to untrusted users where possible.