AcyMailing Shoots Itself in the Foot With a Vanishing Update Site

AcyMailing 11.1.0 went out on 24 September 2026 with two security fixes, and two days later the Joomla CNA gave them CVE numbers: CVE-2026-94132, a 9.5 Critical file write through mailbox actions, and CVE-2026-94131, a file deletion rated 8.3 High. We covered both in our 11.1.0 post. Since then a proof-of-concept for the first one has been published on GitHub, so updating is no longer a job for next week.

A lot of Joomla sites running AcyMailing will not tell you there is anything to update, though. A Joomla developer pointed out on 30 September that a site on 10.11.1 reports itself up to date, and another found that the update sites were gone from every AcyMailing site they looked after. We traced it to a design choice in AcyMailing’s installer, and to the button almost every Joomla guide tells you to press when updates stop appearing.

TL;DR

• AcyMailing’s Joomla package declares no update server in its XML manifest. Its install script inserts the update site into the database instead.
• Joomla’s Rebuild button in Update Sites deletes every non-core update site and recreates only the ones manifests declare, so it removes AcyMailing’s and cannot put it back.
• With no update site, Joomla reports AcyMailing as up to date on any version, including those below 11.1.0.
• Across the AcyMailing sites mySites.guru monitors, one in four sites still below 11.1.0 has no AcyMailing update site. On 10.11 it is more than half.
• Installing the current package over the top brings the update site back, but every Rebuild deletes it again, over and over, until AcyMailing puts the missing <updateservers> values in its XML manifest.
• Acyba confirmed on 1 October that it knows. It says its licence system cannot work through Joomla’s update system and that Rebuild changed recently. Joomla’s source shows both are wrong: the licensing features exist and Acyba has not implemented them, and Rebuild has behaved the same way since 3.6. A second reply the same afternoon promises a fixed version “in the next days”.
• On 2 October Acyba said the problem had not been reported until recently. Its own forum has threads about missing AcyMailing update sites going back to July 2019, answered by forum moderators with “reinstall it”.
• AcyMailing 11.1.1, released on 5 October, fixes it: the update server is in the manifest and Rebuild keeps the licence key. Sites that already lost their update site still need one reinstall to get there.

Where AcyMailing keeps its Joomla update site

A Joomla extension normally tells Joomla where to look for updates in its XML manifest, in an <updateservers> block. When the extension is installed, Joomla’s own “Extension - Joomla” plugin reads that block and writes the row into #__update_sites. The manifest stays on disk, so Joomla can always rebuild the row from it.

AcyMailing does not do that. We opened all the AcyMailing Joomla packages we could get hold of, from 10.10.2 to 11.1.0, in the Starter, Essential and Enterprise editions, and not one pkg_acymailing.xml or acym.xml contains an <updateservers> element. Instead, the package’s install script, pkg_acymailing.php, does the job itself after every install or update:

// 1 - Clear existing updates on AcyMailing extensions
acym_query('DELETE FROM #__updates WHERE extension_id IN (...)');
// ...deletes every update site linked to AcyMailing's extensions...

// 2 - Add the new update XML
$updateSiteDefinition->location = ACYM_UPDATEME_API_URL
    .'public/updatexml/component?extension=acymailing'
    .'&cms=joomla&version=latest&level=starter&type=package';
$updateSiteId = acym_insertObject('#__update_sites', $updateSiteDefinition);

The paid editions use level=essential or level=enterprise and add the site’s own URL, which is how Acyba ties the download to a licence. The method is the same, apart from the edition name, in all the packages we checked from 10.10.2 to 11.1.0.

The feed itself works: on 30 September 2026 it answered 11.1.0 for all three editions. The weak point is that the only record of where the feed lives is a database row, and no file on disk can recreate it.

How AcyMailing’s update site has changed since 2020

The design is older than 10.10.2. Acyba publishes the AcyMailing component on GitHub, with tags from 6.13.1 in July 2020 onwards, and we diffed the update-site code at each of the 145 tags, then the packages we hold from 10.10.2 to 11.1.0. The address has moved several times. How it is registered has stayed the same: a row inserted from PHP, with no <updateservers> in acym.xml or pkg_acymailing.xml.

The update address has not included a licence key at any point. The only value that differs from one site to the next is the &website= parameter on the paid editions, and the Starter address is identical on every site, so it could sit in the manifest as it is. We cannot say when &website= arrived: the packages from 9.11.0 to 10.10.1 are not in the repository, and Acyba’s download server returns “The version was not provided or is incorrect” for any version other than the latest.

What Joomla’s Rebuild button does to AcyMailing

Joomla has a Rebuild button in the toolbar of System, Update Sites. It was added in 2016 in joomla-cms #9744, described as rebuilding the update sites “from the manifest files”, and the code in UpdatesitesModel::rebuild() does exactly that on Joomla 4, 5 and 6. It deletes every row from #__update_sites, #__update_sites_extensions and #__updates except Joomla’s own core sites, then walks every extension manifest on disk and recreates an update site for each one that has an <updateservers> block. It never runs an extension’s install script.

For most extensions that is harmless, and it is the standard advice when updates go missing. Admin Tools’ documentation sends you to it, Akeeba’s support desk has recommended it since at least 2017, and our post on Joomla update expiry errors suggests a rebuild and re-check too. For AcyMailing it is the one click that removes the update site for good. The row is deleted, there is no manifest to rebuild it from, and from then on Joomla has no feed to ask about AcyMailing. When Joomla has nothing to ask, the Extensions: Update screen shows no AcyMailing update, and the site looks up to date.

Rebuild is not the only way to lose it: deleting the row by hand in the Update Sites view does the same. What makes Rebuild the common cause is timing: it is the step people take when updates look broken, so it tends to happen on the sites that most need an update.

How many AcyMailing sites have lost their update site?

Across the Joomla sites mySites.guru monitors that ran a snapshot in the 14 days to 30 September 2026, one in eight sites running AcyMailing has no AcyMailing update site at all. The sites to worry about are the ones that need 11.1.0 and cannot see it. About 40% of those AcyMailing sites were still below 11.1.0, and among them one in four had no update site. For those sites the Joomla updater is silent about a 9.5 Critical fix.

Broken down by the installed version, the pattern is hard to miss:

The 10.11 figure looks like a bug in that release, but the update-site code in its installer is the same as in 11.1.0. What it shows is a selection effect. Sites that could see updates moved on to 11.0 and 11.1 over the summer. The sites still sitting on 10.11 are, more often than not, the ones whose Joomla stopped hearing about new versions. The older a version looks in your list, the more likely it is that nobody was ever told about the newer one.

How do I get the AcyMailing update site back in Joomla?

Install the current AcyMailing package over the top of the existing install. The package’s install script runs again, clears out any AcyMailing update sites it finds, and inserts a fresh one. Your lists, subscribers, campaigns and settings are untouched, because this is the same process as any normal AcyMailing update, and AcyMailing’s own update guide gives it as the fallback when the updater fails.

1. Download the edition the site already runs. Starter is free from acymailing.com; Essential and Enterprise packages are in your AcyMailing account under the licence.
2. In the Joomla administrator, go to System, Install, Extensions and upload the package. Do not uninstall AcyMailing first; an install over the top is all it needs.
3. Open System, Update Sites and search for AcyMailing. There should be one enabled entry pointing at api.acymailing.com.
4. If the site is on 11.1.1 or later, you are done and Rebuild is safe again. On anything older, treat Rebuild as off limits. If you have to use it for another extension, reinstall AcyMailing straight afterwards, every time.

Installing 11.1.0 this way also closes the two CVEs, so on a site below 11.1.0 one upload does both jobs. Check any AcyMailing add-ons afterwards: 11.1.0 breaks some older ones with a PHP fatal error.

What mySites.guru sees when Joomla sees nothing

mySites.guru records the installed version of every extension on every connected Joomla site, and compares it with our Joomla vulnerability rules. The AcyMailing rule for versions below 11.1.0 went live on release day. That comparison uses the version number, not Joomla’s update data, so a site with no AcyMailing update site is still flagged as vulnerable on its dashboard and in its audit, even while its own Joomla administrator says there is nothing to do.

What we cannot do for such a site is update it for you. mySites.guru’s one-click updates, bulk updates and automatic extension updates all start from the update Joomla reports, so they need an update site to work from. On a site that has lost it, the vulnerability flag is your warning and the reinstall above is the fix. Once the update site is back, those tools pick AcyMailing up again from the next snapshot.

If you are a subscriber, the AcyMailing extension search lists all your installs grouped by version. A site still showing 10.11 or 11.0 there after this week is worth a closer look. The vulnerable extension list puts it together with every other flagged extension across your sites.

This is the second update-channel failure we have written up today. OrdaSoft fixed a SQL injection and a CVSS 10.0 upload flaw in OS CCK 8.3.16 while its update server kept offering 8.3.14. The two failures differ, and the lesson is the same: a patch that exists does not mean a patch is reaching anyone, so check the installed version, not the update screen.

What Acyba says, and what Joomla does

We wrote to Acyba support on 30 September, copying the Joomla Security Strike Team, and had an answer the next morning. It confirms the cause above and explains the reason. Acyba’s licence system has to identify the customer before it can return a download URL or an expired-licence message, and a manifest URL is the same for everyone. So Acyba has never declared update servers in its XML manifest and writes the update site row, with the licence information in its URL, from the install script. It says Rebuild “recently changed”, or that AcyMailing stopped being compatible with it, and that it is working on a workaround that has to cover Joomla 3 to 6. It asked whether Joomla can add dynamic parameters to the update server URL when it is called.

Joomla already supports what Acyba asked for. We checked the 3.10 and current source trees:

That is how other commercial Joomla extensions license their updates: the update feed is declared in the manifest, the customer’s key travels with the download, and the vendor’s server accepts it or refuses it with a message. One limit applies. Before Joomla 5.3 there is no hook on the XML request, so a vendor on older versions cannot change which version is offered per licence, only whether the download is allowed.

Rebuild has not changed in the way Acyba describes. UpdatesitesModel::rebuild() has been marked @since 3.6, it deletes every non-core update site and recreates them from manifests, and the 3.10 code does the same. The only behavioural change to it since is the 3.9.26 one that preserves extra_query; the commits after 4.0 are refactoring, such as database injection and the PSR-12 conversion. The one recent change nearby, joomla-cms #45388 in Joomla 5.3.1, is in the extension plugin rather than Rebuild: it updates an existing row when an extension’s manifest moves its update server, and it only runs for manifests that declare one, so AcyMailing is unaffected. A row that an install script inserts with its own location has always been deleted by a Rebuild, on every Joomla version, which is why AcyMailing sites lose it.

Our reply to Acyba included a short installer plugin that adds a licence key to both requests. We have not run it against a live AcyMailing licence server, so treat it as a sketch of the mechanism.

Acyba answered again that afternoon, and the tone had changed. It thanked us for “the reminder and the explanation”, said it already knew about the problem and had found the documentation, and that it was already working on it. It also said that because AI tools now let anyone produce security reports, more and more of them are being published, which leaves less time for features and bugs that are not security issues. It closed by promising a new version of the plugin “in the next days” with the fix.

We welcome the commitment. The two replies are hard to square, though. The first asked whether Joomla could add the very capability the second says Acyba had already found documented, and a rising number of security reports does not explain an update channel that has relied on a database row since at least 6.13.1 in July 2020. We also do not see a missing update site as competing with “features and bugs” for time. On a site that has lost it, no AcyMailing update reaches the administrator at all, security releases included, and that is a security problem in its own right.

Reported on Acyba’s forum since 2019

Acyba’s third reply, on the morning of 2 October, explained that support relays messages for the developers, and that the development team had settled on declaring the update server in the manifest. It also said this:

Our update mechanism worked as expected for years, and until recently it had not been reported to us as a problem.

Acyba’s own forum at forum.acymailing.com has threads about missing AcyMailing updates and update sites going back more than seven years. We sent six of them back to Acyba on 2 October. A search of all 18,206 posts on the forum then found thirteen more, and all nineteen are below:

The 2019 and 2020 threads are mostly about AcyMailing 4 and 5, an older product line, so they show the same symptom rather than the same code. From 2021 they are about the current product: 7.4 with no update notification, a 7.5 plugin whose manifest names no update server, licensed 7 and 8 sites, 9.11.1, and the January 2023 threads that name Rebuild as the cause. In 2022 a moderator twice told users to remove the AcyMailing update sites and reinstall, and once to rebuild and then reinstall, which only makes sense if Rebuild cannot restore the entry on its own. The December 2025 post was written by a paying customer who had already been through Acyba’s support desk. Over seven years the answer stayed the same: reinstall, which restores the database row until the next Rebuild deletes it again.

Most answers come from two accounts with the forum’s moderator role, and two more answers come from accounts in its admin group. The forum does not say whether any of them work for Acyba, so we have not described them as staff, although one moderator writes of “our developers” and “our update server”. Either way, the reports were made on Acyba’s own forum, and the 2025 post records the same advice coming from Acyba’s support desk.

The fix belongs in AcyMailing’s Joomla manifest

A <updateservers> block in pkg_acymailing.xml pointing at the Starter feed would let Joomla rebuild a working update site, and the install script could go on replacing it with the licensed URL as it does now. Declaring a download key with <dlid> is the standard way to attach a licence to an update feed without writing to the database by hand. Either change is a few lines, and either would mean Rebuild repairs AcyMailing instead of breaking it.

We wrote that on 30 September. Five days later Acyba shipped the first of those two changes.

What AcyMailing 11.1.1 changes

AcyMailing 11.1.1 came out on 5 October 2026. Its changelog says: “The update system has been changed to better match the Joomla updater intended usage. Information on expired licenses can no longer be displayed in the Joomla updater but rebuilding the update site is now possible.” On 7 October we opened the free Starter package and the Enterprise package and checked them against Joomla 6.1’s source:

• pkg_acymailing.xml now has an <updateservers> block pointing at api.acymailing.com/public/updatexml/component?extension=acymailing&cms=joomla&level=<edition>&type=package. The address no longer has version=latest or the site’s own URL in it, so it is the same on every site running that edition.
• The delete-then-insert code in the install script is gone. A new function, acym_syncUpdateSite(), finds the update site Joomla created from the manifest by that exact address and writes licenseKey=<your key> into its extra_query. It runs after every install or update and again whenever a licence key is saved in AcyMailing’s configuration, and it removes the old-style AcyMailing update sites left behind by earlier versions.
• Joomla appends extra_query to the package download URL, and Acyba’s download server reads it. With no key it answers “The license key was not provided”, and with a made-up one “The license was not found”.
• Rebuild backs up each update site’s extra_query by address and restores it when a manifest declares the same address. The address in Acyba’s PHP and the one in its XML are identical, so a Rebuild on 11.1.1 recreates the AcyMailing update site with the licence key still attached.

That is the manifest fix described above, done the way Joomla intends, and it ends the reinstall-after-every-Rebuild routine. Two smaller gaps remain.

1. There is still no <dlid> element. Joomla only treats an update site as taking a download key when the manifest declares one. Without it, Joomla removes the Download Key field from AcyMailing’s entry in System, Update Sites, and its warning about extensions missing a download key skips AcyMailing. The key can only be entered in AcyMailing’s own configuration. One line, <dlid prefix="licenseKey=" suffix=""/>, matches the format Acyba already writes and would switch both on.
2. Licence errors come back as HTTP 200. When the key is missing, wrong or expired, the download server answers with status 200 and a line of text where the zip should be. Joomla only rejects a download whose status is not 200, so it saves that text as the package and fails later when it cannot unpack it, and the administrator never sees why. That is presumably what the changelog means by expired-licence information no longer showing in the Joomla updater. With a 401 or 403, Joomla would stop at the download step with “Error connecting to the server: 403”, which at least points at the licence.

Neither gap stops an update reaching a correctly licensed site.

What to do now depends on what the site can see. If Joomla offers 11.1.1, update as normal, and Rebuild is safe from then on. If Joomla says AcyMailing is up to date on anything below 11.1.1, its update site is already gone and it will not hear about this release either, so install 11.1.1 over the top one last time. On Essential and Enterprise, check the licence key is saved on the License tab of AcyMailing’s configuration afterwards, because that is where the update site now gets it from. Check the version number yourself, or let mySites.guru check it for every site you look after.