YOOtheme Pro (yootheme) below 4.5.34 - Authenticated SQL Injection (CVSS 8.6), Arbitrary File Read (CVSS 7.0) and Broken Access Control

YOOtheme Pro

Affected versions: < 4.5.34

Full advisory: www.cve.org

YOOtheme Pro - YOOtheme Pro (yootheme) below 4.5.34 - Authenticated SQL Injection (CVSS 8.6), Arbitrary File Read (CVSS 7.0) and Broken Access Control (CVSS 5.1)

YOOtheme Pro below 4.5.34, the Joomla 3 branch, has three flaws reachable by an authenticated user who can edit templates. CVE-2026-76613 (CVSS 8.6) is an SQL injection in the page builder's article and tag source ORDER BY handling. CVE-2026-75115 (CVSS 7.0) is an arbitrary file read via a glob-pattern escape in the Filesystem source path filter. CVE-2026-77997 (CVSS 5.1) is a missing authorisation check in the module controller that returns any module's configuration to a user who holds only com_templates edit rights. All three are fixed in 4.5.34, released 24 August 2026. Update to 4.5.35, released 25 August 2026, which adds a regression fix for custom-field ordering in the Articles model. Sites on 1.x, 2.x, 3.x or 4.0 to 4.4 have no fixed release on their own line: the fix is to move to 4.5.35, or to migrate to the 5.0.x branch on Joomla 4/5/6. All three CVEs are scored PR:H, so an attacker needs an existing privileged account rather than anonymous access.

Affected versions: < 4.5.34

Full advisory: www.cve.org

YOOtheme Pro - YOOtheme Pro (yootheme) 5.0.41 - Authenticated Broken Access Control in Module Controller (Information Disclosure, CVSS 5.1)

YOOtheme Pro 5.0.41's Page Builder module controller (ModuleController::getModule()) had no permission check of its own, unlike its sibling save endpoint which already required core.edit on com_modules.module.{id}. Reaching it via GET /index.php?option=com_ajax&p=/module&id=<id> returned that module's title, full params JSON (which can include API keys, raw HTML or JS, and other sensitive module configuration) and rendered content, for any module id on the site, published or unpublished. Published as CVE-2026-77997 by the Joomla CNA on 25 August 2026, CVSS 4.0 base 5.1 Medium (AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N). The affected range on the record is 1.0.0 to 5.0.41. Exploitation requires an authenticated user who already holds core.edit on com_templates. YOOtheme's CheckUserPermission middleware runs on every route the framework dispatches and aborts with 403 (or redirects a guest to the login page) unless that permission is held, and the /module route does not opt out of it as the newsletter and image routes do. This is therefore a privilege boundary crossed sideways rather than an anonymous read: a user trusted to edit templates could read the configuration of any module on the site without holding any com_modules permission at all. Fixed in 5.0.42, which adds an explicit $user->authorise('core.edit', 'com_modules.module.{id}') check to getModule(). Confirmed by diffing the 5.0.41 and 5.0.42 packages and tracing the full request path. Note that YOOtheme Pro installs as both a template and a system plugin, and both report the element yootheme, so a single site normally shows two rows for this. Updating YOOtheme Pro updates both together. Update YOOtheme Pro to 5.0.42 or later through the Joomla Extensions manager, or download it from your YOOtheme account.

Affected versions: ≥ 5.0.41 and < 5.0.42

Full advisory: www.cve.org

YOOtheme Pro - YOOtheme Pro (yootheme) 5.0.41 - Authenticated Broken Access Control in Module Controller (Information Disclosure, CVSS 5.1)

YOOtheme Pro 5.0.41's Page Builder module controller (ModuleController::getModule()) had no permission check of its own, unlike its sibling save endpoint which already required core.edit on com_modules.module.{id}. Reaching it via GET /index.php?option=com_ajax&p=/module&id=<id> returned that module's title, full params JSON (which can include API keys, raw HTML or JS, and other sensitive module configuration) and rendered content, for any module id on the site, published or unpublished. Published as CVE-2026-77997 by the Joomla CNA on 25 August 2026, CVSS 4.0 base 5.1 Medium (AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N). The affected range on the record is 1.0.0 to 5.0.41. Exploitation requires an authenticated user who already holds core.edit on com_templates. YOOtheme's CheckUserPermission middleware runs on every route the framework dispatches and aborts with 403 (or redirects a guest to the login page) unless that permission is held, and the /module route does not opt out of it as the newsletter and image routes do. This is therefore a privilege boundary crossed sideways rather than an anonymous read: a user trusted to edit templates could read the configuration of any module on the site without holding any com_modules permission at all. Fixed in 5.0.42, which adds an explicit $user->authorise('core.edit', 'com_modules.module.{id}') check to getModule(). Confirmed by diffing the 5.0.41 and 5.0.42 packages and tracing the full request path. Note that YOOtheme Pro installs as both a template and a system plugin, and both report the element yootheme, so a single site normally shows two rows for this. Updating YOOtheme Pro updates both together. Update YOOtheme Pro to 5.0.42 or later through the Joomla Extensions manager, or download it from your YOOtheme account.

Affected versions: ≥ 5.0.41 and < 5.0.42

Full advisory: www.cve.org