Joomla! CMS 5.4.9 and 6.1.4 security update fixes ten flaws including MFA bypass, SSRF and XSS

What happened

Joomla! has published a security announcement covering ten vulnerabilities in Joomla! CMS. The most prominent is CVE-2026-92227, an authentication flaw in which a remember-me cookie is issued prematurely. This can allow multi-factor authentication to be bypassed for affected login flows, weakening account integrity.

CVE-2026-92222 is a server-side request forgery in core extensions: a user with high privileges can cause the server to make requests to internal or untrusted URLs because server-side request validation was improper. Several access-control flaws are also addressed. CVE-2026-90913 and CVE-2026-92226 let unauthorised users perform mutation or edit actions through webservice endpoints. CVE-2026-90917 lets unauthorised users view tagged content from categories they cannot access. CVE-2026-90907 allows creation of guest-level user accounts on sites where user registration is disabled. CVE-2026-90915 allows arbitrary directory deletion through a cache purge path traversal.

Three cross-site scripting issues are fixed: an InputFilter HTML5 entity decode mismatch (CVE-2026-92231), an InputFilter bypass using whitespace in HTML data URIs (CVE-2026-92232), and missing escaping in HTML mail templates (CVE-2026-90918). No exploitation has been reported or publicly disclosed, and none of these flaws is listed in CISA's KEV catalogue.

Who is affected

Joomla! CMS versions 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3 are affected by most of these flaws. CVE-2026-92231, CVE-2026-92232 and CVE-2026-90907 additionally affect older CMS releases from 1.5.0. The Joomla! Framework Filter package 1.0.0 through 3.0.6 and 4.0.0 through 4.1.0 is also affected by CVE-2026-92231 and CVE-2026-92232. Joomla! typically serves public websites, portals and intranet content; if you operate any of these, confirm your exact branch and version.

What to do now

1. Update Joomla! CMS to 5.4.9 if you are on a 5.x release, or 6.1.4 if you are on a 6.x release. These are the vendor's fixed versions and address all ten CVEs in this announcement.
2. If you run the Joomla! Framework Filter package 1.0.0–3.0.6 or 4.0.0–4.1.0, no fixed release has been published in this advisory. Restrict its use and watch for vendor follow-up.
3. Back up files and database before updating and test on a non-production instance if you can.
4. If an immediate update is not possible, restrict network access to admin and webservice endpoints, and monitor administrative changes. Joomla! has not published a workaround for these flaws.

Beyond the patch

This bundle shows how one CMS update can contain authentication, injection and access-control gaps that matter at different stages of an attack. Once the update is applied, Implementation & Assessment Services can verify that your Joomla! deployments and related extensions are hardened against these flaw classes, and Managed Detection & Response can watch for credential abuse and unauthorised administrative changes.