CVE-2026-35220

No fix known EPSS <1%CVSS 4.6

Lack of CSRF token validation lead to a CSRF attack vector in the admin activation endpoint of com_users.

Published 2026-05-26 · CVE record · OSV

Products: Joomla! Project Joomla! CMS