The Fabrik extension for Joomla contains an improper access control vulnerability (CWE-284) in its inlineedit form controller. Specifically, versions from 1.0.0 up to and including 4.7.3 do not verify user permissions before disclosing data rows, enabling unauthorized data disclosure without authentication. This vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity impact with network attack vector, low complexity, and no privileges or user interaction required. No official patch or remediation level has been published as of the data provided.

Unauthorized users can access and disclose data rows via the inlineedit form controller without authentication or permission checks. This could lead to exposure of sensitive or confidential information stored in the Fabrik extension's forms. There is no indication of privilege escalation, data modification, or service disruption from the available information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor the vendor's announcements for updates. Until a patch is available, restricting access to the Fabrik inlineedit functionality or disabling the affected feature may reduce exposure.