The Fabrik extension for Joomla contains an improper access control vulnerability (CWE-284) in versions 1.0.0 to 4.7.1. The ajax_tables method of the elements model can be invoked without authentication, enabling attackers to enumerate arbitrary database tables and their prefixes. This information disclosure could aid further attacks by revealing database schema details. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity. No official patch or remediation level has been documented at this time.

An unauthenticated attacker can obtain a list of database tables and their prefixes from the Joomla Fabrik extension, potentially exposing sensitive database structure information. This disclosure may facilitate further exploitation or data breaches by revealing internal database details. There is no indication of direct data modification or privilege escalation from this vulnerability alone.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the ajax_tables method if possible or apply compensating controls to limit exposure. Monitor vendor communications for updates on patches or official mitigations.