CVE-2026-76602: CWE-89: Improper Neutralization of Special Elements used in an SQL Command in fabrikar.com Fabrik extension for Joomla

CVE-2026-76602 describes an unauthenticated SQL injection vulnerability in the Fabrik extension for Joomla, specifically affecting versions up to and including 4.7.3. The vulnerability occurs because the 'order' parameter in list models is directly used in SQL queries without validation or sanitization, enabling attackers to perform read-based SQL injection attacks. This improper neutralization of special elements in SQL commands is classified under CWE-89. No official remediation or patch information is currently available from the vendor or advisory sources.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to perform SQL injection attacks, potentially leading to unauthorized reading of database information. Given the critical CVSS score of 9.3, the impact includes high confidentiality, integrity, and availability concerns. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected functionality or applying custom input validation on the 'order' parameter to mitigate injection risks.