Joomla fixes ACL violation vulnerability after 2 years

The development team behind popular CMS Joomla which powers over 2.5 million sites has patched an access control violation vulnerability this week.

Tracked as CVE-2020-35616, the vulnerability is an input validation flaw when checking permissions that can allow users to bypass rules set by Access Control Lists (ACLs).

“Lack of input validation while handling ACL rulesets can cause write ACL violations,” states the Joomla security advisory.

Although the flaw was reported on 4th November 2018, it was fixed this month by Joomla team on 24th December 2020.

Rohan Sharma, a security researcher from SecureLayer7 explained if exploited, this vulnerability could enable attackers (authenticated CMS users) to access areas of Joomla CMS, such as Categories, which are otherwise restricted to certain user groups.

Sharma demonstrated how a Category created by the Manager user and restricted to Administrator could be accessed by the Administrator user by POSTing a crafted payload, shown below, to the CMS:


The flaw impacts all Joomla CMS versions from 1.7.0 to 3.9.22 (inclusive).

Joomla team has fixed the flaw in version 3.9.23 by adding a validate function that appropriately checks permissions, as shown below.

Users of Joomla CMS are encouraged to upgrade their installations to fixed version(s) 3.9.23 and above.

A PoC video demonstrating the exploit for CVE-2020-35616 has been provided by SecureLayer7:

Although the flaw, if exploited, has a High impact considering restricted resources can be accessed by users which were otherwise not supposed to access them, it has been assigned a Low severity rating because the users need to be authenticated.

Ax Sharma

Ax Sharma is a Security Researcher and Tech Reporter. His works and expert analyses have frequently been featured by leading media outlets including the BBC, Business Insider, Fortune, TechCrunch, TechRepublic, The Register, WIRED, among others. Ax's expertise lies in vulnerability research, malware analysis and reverse engineering, open source software and scams investigations. He's an active community member of British Association of Journalists (BAJ) and Canadian Association of Journalists (CAJ).

Recent Posts

Sea Turtle Cyber Espionage Campaign Targets Telecommunication and IT Companies in the Netherlands

Telecommunication, media, internet service providers (ISPs), information technology (IT)-service providers, and Kurdish websites in the…

5 months ago

Rogue WordPress plugin: Threat hunters uncover credit card skimming campaign targeting e-commerce sites

Rogue WordPress Plugin Found to Steal Credit Card Information in Magecart Campaign Threat hunters have…

5 months ago

Albanian Parliament and telco ‘One Albania’ suffer cyber attacks

The Assembly of the Republic of Albania and telecom company One Albania have recently fallen…

5 months ago

Carbanak Banking Malware Resurfaces with Updated Tactics in Ransomware Attacks

The banking malware Carbanak has resurfaced with updated tactics, incorporating attack vendors and techniques to…

5 months ago

Theme park giant Parques Reunidos hit by a ransomware cyber attack

One of the world's largest theme park operators, Parques Reunidos has disclosed a cybersecurity incident.…

1 year ago

Phishing kit screenshots your email domain on the fly to appear real

Phishing kit used by multiple hacked sites generates a log in page on the fly…

2 years ago

This website uses cookies.