CVE-2026-76571

Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2 - The condition parameter passed to a list filter is concatenated verbatim into the WHERE clause built by getFilterQuery(). An unauthenticated attacker can supply arbitrary SQL through the filter condition, giving full read of the database.

Score

CVSS 4.0 9.3 Critical

Status

Deferred - security@joomla.org

Published

2026-08-22

Last modified

2026-10-23

Weaknesses

CWE-89

Affected products

• Fabrik Extension For Joomla (Fabrikar.com)

References

• https://www.fabrikar.com/