CVE-2023-23752: Joomla! webservice endpoints improper access check

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with a near-maximum EPSS score and unauthenticated network reachability, so exploitation is effectively certain for exposed instances.

What it is

Joomla! 4.0.0 through 4.2.7 contains an improper access check that allows unauthenticated access to webservice endpoints. Because the endpoints can expose configuration data, this is a serious information disclosure flaw in a widely deployed CMS. It was added to CISA KEV, confirming real-world exploitation.

Impact

An unauthenticated attacker can reach webservice endpoints that should require authorization and read data they are not entitled to, including potentially sensitive configuration values. The CVSS impact is limited to confidentiality (C:L) with no integrity or availability effect.

Attack surface

Reachable over the network via HTTP against the Joomla! webservice API; the CVSS vector shows no privileges required and no user interaction, so any internet-facing instance is directly exposed.

Exploitation

CISA added it to KEV on 2024-01-08 with a remediation due date of 2024-01-29, and EPSS gives a 30-day probability of 0.99827 (99.96th percentile), indicating active, near-certain exploitation. No ransomware campaign use is documented.

What to do

• Upgrade Joomla! to a version later than 4.2.7 per the vendor security advisory
• If immediate patching is not possible, restrict or block access to the webservice API endpoints at the web server or WAF
• Remove or disable unused webservice plugins and avoid exposing the API to the public internet
• Rotate any credentials or secrets that may have been exposed through the endpoints
• Verify remediation against the CISA KEV required action and track the due date

Detection

• Review web server and proxy logs for requests to Joomla! webservice API paths from unexpected or unauthenticated sources
• Alert on anomalous or high-volume access to /api/ endpoints, especially outside normal administrative patterns
• Monitor for post-exploitation activity such as new administrative accounts or configuration changes following API access
• Correlate source IPs hitting the webservice endpoints with threat intelligence feeds

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.