Summary
CVE-2026-76571 is an unauthenticated SQL injection vulnerability in the Fabrik extension for Joomla, affecting versions 1.0.0 through 4.7.3. The flaw resides in the list filter condition parameter, which is concatenated directly into a database query without sanitization, allowing a remote, unauthenticated attacker to read the entire backing database. The issue carries a CRITICAL CVSS v4.0 score of 9.3.
Technical details
- Root cause: the "condition" parameter passed to a Fabrik list filter is concatenated verbatim into the WHERE clause built by the
getFilterQuery()function, without input validation or parameterization. - Trigger conditions: any request to a Fabrik list view that exposes the filter feature can be manipulated by supplying crafted SQL in the condition parameter.
- Attack vector: network-based, requires no authentication and no user interaction.
- Impact: full read access to the site’s database (confidentiality, integrity, and availability impact all rated High), which can expose credentials, personal data, and other sensitive records stored by the Joomla site.
Affected software
- Fabrik extension for Joomla, versions 1.0.0 through 4.7.3 (all releases prior to 4.7.3).
Severity
- CVSS v4.0 Base Score: 9.3 (CRITICAL)
- Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Mitigation and recommended actions
- Immediate: upgrade Fabrik to version 4.7.3 or later, which addresses the unsanitized filter condition parameter.
- If immediate patching is not possible: disable or restrict access to Fabrik list views that expose filter functionality, and deploy a web application firewall rule to block SQL injection patterns in list filter request parameters until the upgrade can be applied.

