PT-2021-16931 · Joomla · Joomla!

Nicholas Dionysopoulos · Published 2021-07-07 · Updated 2025-04-03 · CVE-2021-26038

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Joomla! versions 2.5.0 through 3.9.27

Description An issue was discovered in the install action of com installer, where it lacks the required hardcoded ACL checks for superusers. However, a default system is not affected because the default ACL for com installer is already limited to super users.

Recommendations For Joomla! versions 2.5.0 through 3.9.27, consider restricting access to the com installer component to minimize the risk of exploitation until a patch is available.

Fix

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

BIT-JOOMLA-2021-26038

CVE-2021-26038

Affected Products

Joomla!

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-26038 · Security Note
• https://developer.joomla.org/security-centre/859-20210704-core-privilege-escalation-through-com-installer.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-26038 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-joomla-2021-26038 · Vendor Advisory
• https://t.me/cvenotify/17198 · Telegram Post