← All advisories

Medium severity4.3NVD Advisory· Published May 26, 2026· Updated Jul 20, 2026

CVE-2026-35220

CVE-2026-35220

Description

Lack of CSRF token validation lead to a CSRF attack vector in the admin activation endpoint of com_users.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4

Joomla/Joomla!inferred2 versions
(expand)+ 1 more
- (no CPE)
- cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*range: >=6.0.0,<6.1.1
Joomla/com_usersllm-fuzzy
osv-coords
pkg:bitnami/joomla
Range: >= 6.0.0, < 6.1.1

Patches

Vulnerability mechanics

References

1

developer.joomla.org/security-centre/1037-20260505-core-csrf-in-user-activation-endpointnvdVendor Advisory

News mentions

1

Joomla! May 2026: 18 CVEs Including Critical SQLi, LFI, and Privilege Escalation Flaws
Vypr Intelligence · May 26, 2026