CVE-2026-76601 identifies an improper access control issue (CWE-284) in the Fabrik extension for Joomla, specifically in the order plugin prior to version 4.7.2. The plugin fails to enforce access controls on row reordering operations, enabling unauthenticated attackers to reorder rows without authorization. This flaw affects all versions from 1.0.0 up to and including 4.7.1. No official patch or remediation level has been published at this time.

Unauthenticated attackers can reorder rows in the Fabrik extension, potentially impacting data integrity or application behavior. Since no privilege or user interaction is required, the vulnerability could be exploited remotely without authentication. However, the impact is limited to the ability to reorder data rows and does not include code execution or data disclosure based on the available information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected Joomla extension or disable the order plugin if possible to mitigate unauthorized row reordering.