CVE-2026-76601: CWE-284 Improper Access Control in fabrikar.com Fabrik extension for Joomla

CVE-2026-76601 describes an improper access control vulnerability in the Fabrik extension for Joomla prior to version 4.7.2. Specifically, the order plugin failed to enforce access controls on row reordering operations, enabling unauthenticated users to reorder rows. This flaw affects versions from 1.0.0 up to and including 4.7.1. The vulnerability is classified under CWE-284 and has a CVSS 4.0 score of 6.9, reflecting a medium severity with network attack vector and no privileges or user interaction required.

An attacker without authentication can reorder rows in the Fabrik extension, potentially disrupting data integrity or application behavior. The vulnerability does not require privileges or user interaction, increasing its risk. However, no known exploits in the wild have been reported.

Upgrade the Fabrik extension to version 4.7.2 or later, where this access control issue has been fixed. Since no official patch links are provided, verify the availability of the update from the vendor or Joomla extension repository. Until patched, restrict access to the affected functionality if possible.