CVE-2022-23795: [20220303] - Core - User row are not bound to a authentication mechanism

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-03-30 · updated 2026-06-17
Weakness: CWE-287

Description

An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. A user row was not bound to a specific authentication mechanism which could under very special circumstances allow an account takeover.

Affected products

Joomla!: from 2.5.0 through 3.10.6; from 4.0.0 through 4.1.0

References

https://developer.joomla.org/security-centre/872-20220303-core-user-row-are-not-bound-to-a-authentication-mechanism.html
https://developer.joomla.org/security-centre/872-20220303-core-user-row-are-not-bound-to-a-authentication-mechanism.html

Get alerted when CVE-2022-23795 or the next vulnerability affects your stack