PT-2021-16933 · Joomla · Joomla!

Maverick · Published 2021-08-24 · Updated 2025-04-03 · CVE-2021-26040

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Joomla! version 4.0.0

Description An issue was discovered in the media manager, which does not correctly check the user's permissions before executing a file deletion command.

Recommendations For Joomla! version 4.0.0, update to a version that includes the fix for this issue, as the media manager's incorrect permission checking can lead to unauthorized file deletion. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BIT-JOOMLA-2021-26040

CVE-2021-26040

Affected Products

Joomla!

References · 7

• https://developer.joomla.org/security-centre/861-20210801-core-insufficient-access-control-for-com-media-deletion-endpoint · Vendor Advisory
• https://osv.dev/vulnerability/BIT-joomla-2021-26040 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-26040 · Security Note
• https://osv.dev/vulnerability/CVE-2021-26040 · Vendor Advisory
• https://t.me/cvenotify/20006 · Telegram Post
• https://t.me/cvenotify/20417 · Telegram Post
• https://t.me/cibsecurity/27772 · Telegram Post