CVE-2026-76598: CWE-284 Improper Access Control in fabrikar.com Fabrik extension for Joomla
Description
An improper access control vulnerability exists in the Fabrik extension for Joomla versions up to 4.7.1. The onAjax_getFolders method allows unauthenticated users to perform arbitrary directory listings. This vulnerability is identified as CWE-284 and CWE-22 and has a high severity with a CVSS 4.0 score of 8.7.
CVSS v4.0
Score 8.7high
Affected software
fabrikar.com
Fabrik extension for Joomla
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-76598 describes an improper access control vulnerability in the Fabrik extension for Joomla, specifically in the onAjax_getFolders method of the elements model. This flaw permits unauthenticated attackers to list arbitrary directories on the server, potentially exposing sensitive information. The issue affects versions up to and including 4.7.1. No official remediation or patch information is currently provided.
Potential Impact
The vulnerability allows unauthenticated attackers to enumerate directories arbitrarily, which can lead to information disclosure. This may aid attackers in further reconnaissance or exploitation of the affected system. The CVSS 4.0 score of 8.7 indicates a high impact due to the lack of required privileges and user interaction.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Fabrik extension or disable the vulnerable functionality if possible to mitigate exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Joomla
- Date Reserved
- 2026-08-19T14:48:01.168Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a89b443acd9273b49249727
Added to database: 08/22/2026, 14:37:55 UTC
Last enriched: 09/10/2026, 14:37:20 UTC
Last updated: 10/06/2026, 18:48:25 UTC
Views: 64
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.