Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party developers.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-01 | 1 | General1 |
| 2026-04-03 | 1 | Patch1 |
CVE-2026-21629 CVE-2026-21630 CVE-2026-21631 CVE-2026-21632 CVE-2026-23898 CVE-2026-23899 Joomla 6.0.4 & 5.4.4 Security & Bugfix Release https://www.joomla.org/announcements/release-news/5944-joomla-6-0-4-5-4-4-security-bugfix-release.html
Post summary
Joomla’s 6.0.4 and 5.4.4 security releases address six CVEs (CVE‑2026‑21629, 21630, 21631, 21632, 23898, 23899).
CVE-2026-21629 The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party developers. https://www.cve.org/CVERecord?id=CVE-2026-21629
Post summary
An excerpt of a CVE record noting that CVE‑2026‑21629 involves a missing authentication check for an Ajax component in the admin area, with no PoC, exploit, active exploitation, or patch information provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | joomla | joomla\! | - | - | - |