CVE WatchAug 22, 2026

CVE-2026-76609

Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik < 4.7.2 - The onUpdateComment endpoint did not perfo

CVSS

—

No CVSS

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Aug 22, 2026 · Last modified: Aug 22, 2026 · CWE-284

EPSS · 30d

Not enough EPSS history yet.

Technical description

Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik < 4.7.2 - The onUpdateComment endpoint did not perform any access checks.

Official references

www.fabrikar.comhttps://www.fabrikar.com/

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-76608—

—

———Joomla Extension - fabrikar.com - Unauthenticated disclosure of any commenter's email address in Fabrik < 4.7.2 - The onGetEmail endpoint did not perform any access checks.6h CVE-2026-76607—

—

———Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik < 4.7.3 - ???.6h CVE-2026-76603—

—

———Joomla Extension - fabrikar.com - Unauthenticated row disclosure via form.inlineedit in Fabrik < 4.7.3 - The inineedit form controller does not perform any access checks, disclosing items to unauthorized users.6h CVE-2026-76601—

—

———Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik < 4.7.2 - The order plugin did not perform any access checks.6h CVE-2026-76600—

—

———Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik < 4.7.2 - The DeleteComment endpoint did not perform any access checks.6h CVE-2026-76599—

—

———Joomla Extension - fabrikar.com - Unauthenticated database table list and table-prefix disclosure in Fabrik < 4.7.2 - The ajax_tables method of the elements model allows listings of arbitrary database tables including columns.6h