A critical improper access control vulnerability in the Fabrik extension for Joomla allows unauthenticated remote attackers to compromise sensitive data.

This vulnerability is categorized under CWE-284: Improper Access Control, where the software does not properly restrict access to resources. Based on the CVSS vector (PR:N), this flaw is exploitable by unauthenticated remote attackers.

The ability for an unauthenticated user to bypass access controls presents a severe risk to data confidentiality. If exploited, an attacker could gain unauthorized access to restricted Joomla database records, leading to potential data breaches, regulatory non-compliance, and loss of user trust. The CVSS score of 8.7 reflects the high severity of this unauthorized information disclosure.

Immediate Action: Check the official Fabrikar website for available security patches or updates to versions beyond 4.7.1. If no update is available, consider disabling the extension until a fix is provided.

Proactive Monitoring: Review web server and Joomla application logs for unusual request patterns, particularly those targeting extension-specific URLs or unauthorized database queries.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter malicious requests and restrict access to the Fabrik extension endpoints from untrusted networks.

Public Exploit Available: Unknown

Given the high CVSS score and the lack of authentication required for exploitation, this vulnerability poses a significant risk to Joomla environments. Administrators must prioritize identifying instances of this extension and applying the latest available security updates to prevent unauthorized data access.