CVE-2016-8870: Joomla! Users component registration bypass allows account creation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityThe flaw is remotely exploitable without authentication, public exploit code exists, and EPSS is very high, though the CVSS attack complexity is rated high.

What it is

The register method in the UsersModelRegistration class in Joomla! before 3.6.4 fails to check the Allow User Registration configuration setting. When registration is disabled, a remote attacker can still create user accounts. This matters because it defeats an administrative control meant to keep unauthenticated users out of the site.

Impact

An attacker gains a valid user account on a site where registration was intentionally disabled. Depending on the site's default group assignment, that account can provide a foothold for further privilege escalation.

Attack surface

Reachable over the network through the Users component registration endpoint; no authentication is required and no user interaction is needed. The CVSS vector is AV:N/AC:H/PR:N/UI:N, so the attack is remote but has high complexity.

Exploitation

Not listed in CISA KEV, but EPSS is very high at 0.812 (99.6th percentile), and public exploit code exists (Exploit-DB 40637, Rapid7 module). Exploitation is practical and well documented.

What to do

• Upgrade Joomla! to 3.6.4 or later, which contains the fix commit bae1d43938c878480cfd73671e4945211538fdcf.
• If immediate patching is not possible, block or restrict access to the Users component registration endpoint at the web server or WAF.
• Audit existing user accounts for unexpected registrations created while registration was disabled, and remove any that are not legitimate.
• Review default user group assignments so newly created accounts receive the least privilege possible.

Detection

• Monitor web logs for POST requests to the Joomla! registration endpoint (index.php?option=com_users) on sites where registration is disabled.
• Alert on new user account creation events in Joomla! that occur while the Allow User Registration setting is off.
• Correlate account creation with source IPs and user agents that do not match normal site traffic.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.