Joomla! CMS 5.4.9 and 6.1.4 fix MFA bypass, SSRF, XSS and access control flaws

What happened

The most serious issue is CVE-2026-92227, an MFA authentication bypass in the remember-me cookie flow. Because a remember-me cookie is issued prematurely, an unauthenticated attacker can bypass multi-factor authentication over the network without user interaction; the CVSS 4.0 score is 8.2.

CVE-2026-92222 is a server-side request forgery in core extensions, rated 8.9, that lets a high-privileged user force the server to make requests; this can expose internal systems. Several access control flaws allow unauthorised mutation or edit actions: CVE-2026-90913 in access level webservice endpoints, CVE-2026-92226 in webservice edit tasks, CVE-2026-90917 in tagged item output, and CVE-2026-90915 arbitrary directory deletion via cache purge. CVE-2026-90907 allows unauthorised guest-level account creation on sites without active registration.

The remaining issues are XSS: CVE-2026-92231 and CVE-2026-92232 are InputFilter bypasses, and CVE-2026-90918 is XSS in HTML mail templates. The CVE records do not currently report active exploitation, and none is listed in CISA's Known Exploited Vulnerabilities catalogue.

Who is affected

Most of these flaws affect Joomla! CMS 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3. The XSS filter bypasses (CVE-2026-92231, CVE-2026-92232) and the unauthorised account creation flaw (CVE-2026-90907) also affect Joomla! CMS from 1.5.0. The standalone Joomla! Framework Filter package is affected for versions 1.0.0–3.0.6 and 4.0.0–4.1.0. Joomla sites are usually public-facing; treat the admin interface and web services as exposed unless network access is restricted.

What to do now

1. Update Joomla! CMS to 5.4.9 or 6.1.4, the releases Joomla lists as fixing these issues.
2. For the standalone Joomla! Framework Filter package, no fixed version is listed in the bulletin; review and restrict its use until one is available.
3. No workaround has been published. Restrict access to the Joomla administrator interface and any web services to trusted networks, and monitor for unauthorised account creation, access-level changes or edits.
4. After patching, review user accounts, access levels and cache purge activity for signs of earlier misuse.

How to detect it

Review Joomla logs for new user registrations where registration is disabled, changes to access-level endpoints, edits by unexpected users, unexpected cache purge or directory deletion events, and unusual server-side requests. For the MFA bypass, look for successful logins that do not show a completed multi-factor step in available authentication logs.

Beyond the patch

Joomla is a platform where one forgotten site can become the weak point for the whole organisation. Because these flaws sit in access control and input validation rather than a single patchable component, a penetration test through Implementation & Assessment Services can confirm the update has been applied cleanly and catch similar gaps. For the credential abuse or unauthorised changes that could follow the MFA bypass and account creation issue, Managed Detection & Response can provide continuous monitoring.