CVE-2026-73372
Joomla! Core - [20260809] - Improper ACL checks when injection schema.org contact data in Joomla 5.1.0-5.4.7 and 6.0.0-6.1.2Joomla! Core - [20260809] - Improper ACL checks when injection schema.org contact data in Joomla 5.1.0-5.4.7 and 6.0.0-6.1.2 - An improper access check injects contact information for unaccessible contact items into schema.org snippets.
We have discovered 1,311 live websites that are affected by CVE-2026-73372.
Affected Software
| Product |  Joomla |
| Category | Content Management System |
| Vulnerable Domains | 1,311 live websites (0.98% of Joomla install base) |
| Vulnerable Versions |
|
| Vulnerable Versions Count | 23 versions ( 18% of all versions) |
Common Weakness Enumeration
CWE-284 Improper Access ControlDetails
- Published - Aug 18, 2026
- Updated - Aug 19, 2026
Credits
- Stefan Wendhausen (finder)
CVE References
CWE References
CWE
Website Distribution by Country
Number of websites using CVE-2026-73372 United States | 109 websites |
 Germany | 378 websites |
 France | 148 websites |
 Switzerland | 97 websites |
 Netherlands | 93 websites |
 Russia | 65 websites |
 Austria | 53 websites |
 Italy | 50 websites |
 GB | 43 websites |
 Australia | 22 websites |
Website Distribution by TLD
Number of websites using CVE-2026-73372| .de | 324 websites |
| .com | 187 websites |
| .ch | 90 websites |
| .fr | 86 websites |
| .nl | 82 websites |
| .org | 56 websites |
| .ru | 54 websites |
| .at | 51 websites |
| .net | 45 websites |
| .it | 35 websites |
Vulnerable Versions
Vulnerable versions are highlighted in redWebsites affected by CVE-2026-73372
Top websites that are affected by CVE-2026-73372. Please click on the "Contact us" link to get more information.| Domain | Country | Rank | Contacts |
|---|---|---|---|
| ******.fr |  Canada | **,*** | |
| ************.ru | Russia | **,*** | |
| ******.**.il |  Israel | **,*** | |
| **************.com | France | ***,*** | |
| ********.de | Germany | ***,*** | |
| ****************.at | Austria | ***,*** | |
| *********.de | Germany | ***,*** | |
| ***********.com | Canada | ***,*** | |
| *****.***.pg |  Papua New Guinea | ***,*** | |
| **********.***.ua |  Ukraine | ***,*** |
FAQ
CVE-2026-73372 is Improper Access Control in Joomla
A total of 1,311 websites have been identified as vulnerable to CVE-2026-73372, based on global website indexing conducted by WebTechSurvey.
The Joomla is affected by the CVE-2026-73372 vulnerability.
Joomla versions up to 6.1.3 are vulnerable to CVE-2026-73372.
CVE-2026-73372 is resolved in version 6.1.3 of Joomla.