ZOO (com_zoo) 4.1.64 - Unauthenticated Tag Modification

ZOO 4.1.64 fixed the three critical unauthenticated flaws present in 4.1.63 and below (CVE-2026-74803 arbitrary file upload leading to remote code execution, CVE-2026-74804 SQL injection, CVE-2026-75114 open redirect), but its tag-management hardening was incomplete. That gap is now published as CVE-2026-76610 (CVSS 4.0 base 6.9 Medium, AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N), credited to Phil Taylor of mySites.guru, with an affected range of 1.0.0 to 4.1.64. The Joomla CNA records it as unauthenticated tag modification, stating that the comment controller endpoint lacked ACL checks and so allowed tags to be altered with no login at all. Reading the shipped 4.1.64 package shows the matching administrator-side gap as well: the admin tag controller gained CSRF tokens on its remove and update tasks and a canManageTags() helper was added to the framework, but nothing in the package ever calls that helper and the zoo.tags.manage permission is absent from access.xml, so tag rename and tag delete were gated only by the component-wide core.manage check. On either reading the impact is to content integrity. This is NOT the CVSS 10.0 remote code execution, which 4.1.64 genuinely does fix. YOOtheme shipped the tag fix in 4.1.65 on 19 August 2026, hours after 4.1.64. Do not stop there. ZOO 4.1.66, released on 21 August 2026, fixed three further published CVEs on the front-end submission path (CVE-2026-76611 unauthenticated arbitrary directory listing, CVE-2026-77028 reflected XSS and open redirect, CVE-2026-77029 missing CSRF protection) plus two unannounced hardening fixes on the upload path. Update to ZOO 4.1.66 or later. If you cannot update immediately, restrict backend access to com_zoo to trusted administrators and restrict guest access to any published front-end submission form.

Affected versions: ≥ 4.1.64 and < 4.1.65

Official record: cve.org · NVD

Every connected Joomla site is checked against this rule on each audit, and flagged if it runs an affected version.

Affected extensions and versions