CVE-2026-76607: CWE-284 Improper Access Control in fabrikar.com Fabrik extension for Joomla

CVE-2026-76607 describes an improper access control vulnerability in the Fabrik extension for Joomla, specifically in versions up to and including 4.7.3. The flaw arises from a missing Access Control List (ACL) check in the download element, which could allow unauthorized users to access or download resources they should not have permission to. The vulnerability is rated critical with a CVSS 4.0 score of 10, indicating it is exploitable remotely without authentication and has high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

The vulnerability allows unauthorized remote attackers to bypass access controls and potentially download restricted content or data from the affected Joomla Fabrik extension. This can lead to full compromise of confidentiality, integrity, and availability of the affected system components related to the download functionality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the download element and monitor for suspicious activity related to unauthorized downloads. Avoid exposing the vulnerable component to untrusted networks where possible.