CVE Watch22 ago 2026

CVE-2026-76596

Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik < 4.7.2- The list controllers doemtpy endpoint

CVSS

—

Sin CVSS

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 22 ago 2026 · Última mod.: 22 ago 2026 · CWE-284

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik < 4.7.2- The list controllers doemtpy endpoints lacks ACL gates, a plain GET empties the target list's table

Referencias oficiales

www.fabrikar.comhttps://www.fabrikar.com/

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-76609—

—

———Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik < 4.7.2 - The onUpdateComment endpoint did not perform any access checks.7h CVE-2026-76608—

—

———Joomla Extension - fabrikar.com - Unauthenticated disclosure of any commenter's email address in Fabrik < 4.7.2 - The onGetEmail endpoint did not perform any access checks.7h CVE-2026-76607—

—

———Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik < 4.7.3 - ???.7h CVE-2026-76603—

—

———Joomla Extension - fabrikar.com - Unauthenticated row disclosure via form.inlineedit in Fabrik < 4.7.3 - The inineedit form controller does not perform any access checks, disclosing items to unauthorized users.7h CVE-2026-76601—

—

———Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik < 4.7.2 - The order plugin did not perform any access checks.7h CVE-2026-76600—

—

———Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik < 4.7.2 - The DeleteComment endpoint did not perform any access checks.7h