CVE-2026-76599: CWE-284 Improper Access Control in fabrikar.com Fabrik extension for Joomla

The Fabrik extension for Joomla, versions up to and including 4.7.1, contains an improper access control vulnerability (CWE-284) in the ajax_tables method of the elements model. This flaw permits unauthenticated users to retrieve a list of arbitrary database tables and their prefixes, potentially exposing sensitive database schema information. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity. No official patch or remediation level has been published as of the data provided.

An attacker can obtain unauthorized access to the database schema by listing arbitrary tables and their prefixes without authentication. This information disclosure can aid further attacks such as SQL injection or data exfiltration by revealing database structure details. However, no direct code execution or data modification is indicated by the available information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Fabrik extension's ajax_tables functionality where possible, such as by limiting access to trusted users or IP addresses. Monitor vendor channels for updates and apply patches promptly once released.