PerfoMetrix

All vulnerabilities · Joomla

Joomla API Information Disclosure (CVE-2023-23752): Check and Patch

CVE-2023-23752CVSS 5.3Actively exploited (CISA KEV)

Joomla 4.0.0 to 4.2.7 exposed configuration data, including database credentials, through its web API without login. Update to 4.2.8 or later.

Is your site affected? Check the Joomla version it shows

Passive check: we load your page like a visitor would and read the versions it announces. We never send exploits or attack the site. "Not affected" or "hidden" doesn’t prove a server is safe: a firewall or proxy can hide versions, and only the server itself can confirm its packages.

Affected and fixed versions

AffectedFixed in
>=4.0.0 <4.2.8
4.2.8

An improper access check in Joomla’s web services API let anyone request data that should have required a login, including the site configuration with the database user name and password. Attackers combined it with exposed database ports and password reuse to take sites over, and CISA lists it as actively exploited.

Who is affected

Joomla 4.0.0 to 4.2.7. Joomla 3 doesn’t have this API and isn’t affected by this flaw (but is out of support).

What our check looks at

Joomla 4 doesn’t show its version in the page by default, so in most cases our scan can only tell that a site runs Joomla, not whether this fix is installed. We never call the API in question: that would be an attack, and we only make passive checks.

How to fix it

  1. Update Joomla to 4.2.8 or later (the current 5.x release is best).
  2. If the site ran a vulnerable version while public, change the database password and any credentials stored in the configuration.
  3. Make sure the database port isn’t reachable from the internet.

FAQ

How do I check my Joomla version?

In the administrator panel, see System → System Information, or the footer of the control panel.

We updated. Is anything else needed?

If the site was exposed before the update, assume the configuration was read: rotate the database password and API keys.

Official advisory

Last updated October 27, 2026 · This product uses data from the NVD API but is not endorsed or certified by the NVD.

Monitor your site for free