CVE-2026-77997: CWE-284 Improper Access Control in yootheme.com YOOtheme Pro extension for Joomla
Description
CVE-2026-77997 is a medium severity vulnerability in the YOOtheme Pro extension for Joomla versions 1.0.0 through 5.0.41. It involves improper access control where users with com_template editing permissions can access information about arbitrary modules without having the necessary com_modules permissions. This could lead to unauthorized disclosure of privileged information.
CVSS v4.0
Score 5.1medium
Affected software
yootheme.com
YOOtheme Pro extension for Joomla
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-77997 in YOOtheme Pro extension for Joomla (versions 1.0.0 to 5.0.41) is due to a missing access check. Specifically, users who have permissions to edit com_template can access information about arbitrary modules without holding the required com_modules permissions. This constitutes improper access control (CWE-284) and allows authenticated users with certain privileges to disclose information they should not have access to.
Potential Impact
The impact is limited to information disclosure of module details to authenticated users who have com_template editing permissions but lack com_modules permissions. There is no indication of privilege escalation, code execution, or denial of service. The CVSS 4.0 base score is 5.1 (medium severity), reflecting the network attack vector, low complexity, no user interaction, and limited confidentiality impact.
Mitigation Recommendations
No explicit patch or remediation is stated in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict com_template editing permissions to trusted users only to minimize exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Joomla
- Date Reserved
- 2026-08-21T19:23:55.924Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a8d859aacd9273b49267ee0
Added to database: 08/25/2026, 12:07:54 UTC
Last enriched: 09/10/2026, 19:35:08 UTC
Last updated: 10/09/2026, 06:48:19 UTC
Views: 72
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.