CVE-2026-90907: Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3
The profile.save controller permits unauthorized account creation.
CVE published 2026-09-29 · Record updated 2026-09-30 · Snapshot checked 24 October 2026
Why this matters
The profile.save controller permits unauthorized account creation.
CVSS 4.0: 6.9 (MEDIUM). Source: CVE assigning authority.
A severity score describes the vulnerability, not the probability that your own website has been compromised. Exposure depends on the installed version, configuration and reachable code path.
When to check your system
Affected Joomla 4.0.0–5.4.8 and 6.0.0–6.1.3 core installations.
How to address it
Fixed in 5.4.9 and 6.1.4. Upgrade to the applicable supported patched release.
Record the installed package and vendor build, check the advisory’s prerequisites, back up, apply the vendor fix and test the affected site functions. Distribution packages may include backported fixes without changing the upstream version number.
Sources
This page summarises a selected advisory. It is not evidence that a particular website is vulnerable. Where an advisory covers several CVEs, check the linked record for this CVE’s exact affected range.