CVE-2026-35220

Published: Mag 26, 2026 Last Modified: Mag 26, 2026

ExploitDB:

Other exploit source:

Google Dorks:

MEDIUM 4,6

Source: [email protected]

Attack Vector: network

Attack Complexity: low

Privileges Required: high

User Interaction: active

Confidentiality: N/A

Integrity: N/A

Availability: N/A

AI Translation Available

Lack of CSRF token validation lead to a CSRF attack vector in the admin activation endpoint of com_users.

352

Stable

Abstraction: Compound Structure: Composite

Security Scopes Affected:

Confidentiality Integrity Availability Non-Repudiation Access Control

Potential Impacts:

Gain Privileges Or Assume Identity Bypass Protection Mechanism Read Application Data Modify Application Data Dos: Crash, Exit, Or Restart

Technologies: Web Based, Web Server

Likelihood of Exploit: Medium

https://developer.joomla.org/security-centre/1037-20260505-core-csrf-in-user-ac…