duke42 Security scan & fix Ongoing care
← Back to Duke42

JOOMLA REPAIR & SECURITY

Keep your Joomla site under your control.

We check access controls, extensions and updates, then test the functions your site relies on.

See recent security issues ↓

One-time repair

FIX NOW

Previously €199 Now €99 / one-time repair

Core and extensions · Backup · Security updates · Login, MFA and content checks

Money-back guarantee. If we can’t fix your problem, we’ll refund your payment in full. Prices in EUR; VAT added where applicable.

FREE WEBSITE CHECK

Find your website’s security risks

Recent security issues

4 selected records

24 Jul 2026 – 24 Oct 2026 · Sources checked 24 Oct 2026

Selected Joomla core advisories. Dates below are vendor fix dates, not the earlier private report dates. Extensions require their own checks. This is a selected list, not a complete vulnerability inventory or a scan of your system.

Vendor fix date

CVE-2026-92227

Remember-me cookies bypass MFA

Premature cookie issuance can bypass multi-factor authentication.

Affected systems & fix
Applies to
Affected Joomla 4.0.0–5.4.8 and 6.0.0–6.1.3 core installations.
What fixes it
Fixed in 5.4.9 and 6.1.4. Upgrade to the applicable supported patched release.
Official source ↗
Vendor fix date

CVE-2026-90915

Cache purge can delete directories

A path-traversal issue affects cache-purge actions.

Affected systems & fix
Applies to
Affected Joomla 4.0.0–5.4.8 and 6.0.0–6.1.3 core installations.
What fixes it
Fixed in 5.4.9 and 6.1.4. Upgrade to the applicable supported patched release.
Official source ↗
Vendor fix date

CVE-2026-90907

Unauthorized user account creation

The profile.save controller permits unauthorized account creation.

Affected systems & fix
Applies to
Affected Joomla 4.0.0–5.4.8 and 6.0.0–6.1.3 core installations.
What fixes it
Fixed in 5.4.9 and 6.1.4. Upgrade to the applicable supported patched release.
Official source ↗
Vendor fix date

CVE-2026-73337

Multi-factor authentication state bypass

Missing state checks can bypass two-factor authentication.

Affected systems & fix
Applies to
Joomla 4.0.0–5.4.7 and 6.0.0–6.1.2.
What fixes it
Fixed in 5.4.8 and 6.1.3; include the later September security fixes too.
Official source ↗

Not sure which issues affect you?

Send the site or server address and a working contact. We’ll check the installed versions and configuration before making changes. Missing access? Tell us what you have.

Keep it maintained afterwards. Care from €29/month ↗

LET’S GET IT WORKING

What happened?

Tell us what happened and how to reach you. We’ll arrange access separately — don’t share passwords here.

Can’t access it or don’t know the address? You can still ask for help.

Use another email or your phone if your website’s email is down.

Add details or available access optional

We’ll use your details to respond to this request. Access credentials are arranged separately.