External risk intelligence

Joomla Page Builder CK Frontend Page List Access Control Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-62414

The vulnerability affects a Joomla extension used to manage frontend page views. As a component of a content management system designed to display web pages, this extension is commonly deployed in internet-facing web environments, making the affected interface reachable by the public.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects a Joomla extension that manages frontend page lists, potentially allowing unauthorized access to content. The main concern is confirming whether this specific extension is in use within our environment and, if so, understanding the exposure.

Unauthorized access to content is possible.
Confirms specific extension is in use.
Assess relevance and exposure for potential impact.

Attack Path

How an attacker could exploit the issue

An attacker could potentially access a list of pages managed by the Page Builder CK extension on a Joomla website. This is possible because the extension does not adequately restrict who can view these page lists, even without any prior login. If an attacker can reach this view, the vulnerability could allow them to access sensitive information.

No authentication required.
Frontend page list view.
Unauthorized access to page information.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthorized access to sensitive information or modification of web page content when the Page Builder CK extension is used on a Joomla site. This exposure may occur when an attacker can access the frontend page list views without proper authentication.

Website content and user data could be exposed.
Unauthenticated access to page lists.
Unauthorized content changes or data leakage.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Joomla Page Builder CK extension likely requires action from the application owner responsible for the Joomla CMS, in coordination with the infrastructure or platform team managing the web server environment. The first practical step is to identify all instances of the affected extension, determine their internet reachability and business criticality, and then prioritize remediation efforts based on risk.

Application owners must own the remediation effort.
Verify internet exposure of frontend page lists.
Plan maintenance for immediate remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Page Builder CK for Joomla?

Page Builder CK is a third-party extension designed for the Joomla content management system. It provides a visual interface that helps users create, organize, and manage the layout of web pages. Because it integrates directly into the CMS, it often controls how site content is structured and displayed to visitors on the frontend.

How does CVE-2026-62414 work?

This vulnerability is classified as Improper Access Control (CWE-284). In simple terms, the software fails to verify the permissions of a visitor before displaying certain information. In this specific case, the extension does not enforce security checks, which allows someone to view lists of pages that should otherwise be restricted or hidden.

Do I need to be logged in to trigger this bug?

No, authentication is not required to trigger this vulnerability. The flaw resides in the frontend functionality of the extension. An attacker can reach the page list view directly through a web browser without needing a user account, administrator privileges, or any prior interaction with the site's backend systems.

Why does Halo Surface Signal flag this as relevant?

Halo Surface Signal flags this because the vulnerability involves a component specifically designed for public-facing web pages. Since this extension manages content meant for visitor browsers, it is frequently deployed on internet-accessible servers, making it reachable by anyone on the public web.

When should I take action to address this issue?

You should prioritize this as soon as you confirm the extension is installed in your environment. The first step is to locate all instances of the software and determine if they are exposed to the public internet. Coordinate with your web management team to verify if your specific configuration allows unauthorized access to page lists and plan for a security update.

References

www.joomlack.fr/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.