Affected versions: < 4.5.34
Full advisory: www.cve.org
CVE-2026-77997MediumCVSS 5.1CVE published 25 August 2026Added to mySites.guru 25 August 2026
YOOtheme Pro (yootheme) below 4.5.34 - Authenticated SQL Injection (CVSS 8.6), Arbitrary File Read (CVSS 7.0) and Broken Access Control
YOOtheme Pro below 4.5.34, the Joomla 3 branch, has three flaws reachable by an authenticated user who can edit templates. CVE-2026-76613 (CVSS 8.6) is an SQL injection in the page builder's article and tag source ORDER BY handling. CVE-2026-75115 (CVSS 7.0) is an arbitrary file read via a glob-pattern escape in the Filesystem source path filter. CVE-2026-77997 (CVSS 5.1) is a missing authorisation check in the module controller that returns any module's configuration to a user who holds only com_templates edit rights. All three are fixed in 4.5.34, released 24 August 2026. Update to 4.5.35, released 25 August 2026, which adds a regression fix for custom-field ordering in the Articles model. Sites on 1.x, 2.x, 3.x or 4.0 to 4.4 have no fixed release on their own line: the fix is to move to 4.5.35, or to migrate to the 5.0.x branch on Joomla 4/5/6. All three CVEs are scored PR:H, so an attacker needs an existing privileged account rather than anonymous access.
Is my site affected?
CVE-2026-77997 is checked by 2 rules. Find the extension and release line your site runs:
| Extension | Affected versions | Fixed in | What to do |
|---|---|---|---|
| YOOtheme Pro | before 4.5.34 | 4.5.34 | Update YOOtheme Pro to 4.5.34 or later. |
| YOOtheme Pro | from 5.0.41 up to but not including 5.0.42 | 5.0.42 | Update YOOtheme Pro to 5.0.42 or later. |
How CVE-2026-77997 is scored
The base metrics as Joomla CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.
5.1 Medium
CVSS 4.0, scored by Joomla CNACVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/S:N/AU:NHow it is reached
- AV:N Attack vector
- Network. Reachable across the internet
- AC:L Attack complexity
- Low. Nothing to work around, it just works
- AT:N Attack requirements
- None. Works against any affected install
- PR:H Privileges required
- High. Needs an account with elevated rights
- UI:N User interaction
- None. Nobody has to be tricked into anything
What it does to the site
- VC:L Confidentiality
- Low. Some data can be read
- VI:N Integrity
- None. Nothing can be altered
- VA:N Availability
- None. The site stays up
What it does beyond the site
- SC:N Confidentiality
- None. Other systems keep their data
- SI:N Integrity
- None. Other systems keep their integrity
- SA:N Availability
- None. Other systems stay up
The rule below is rated High for the set of 3 CVEs it covers together, not for this record on its own.
Timeline
- 25 August 2026CVE-2026-77997 record published by its CNA
- 25 August 2026mySites.guru check added for YOOtheme Pro (before 4.5.34)
- 25 August 2026mySites.guru check added for YOOtheme Pro (from 5.0.41 up to but not including 5.0.42)
Rule details
YOOtheme Pro - YOOtheme Pro (yootheme) 5.0.41 - Authenticated Broken Access Control in Module Controller (Information Disclosure, CVSS 5.1)
YOOtheme Pro 5.0.41's Page Builder module controller (ModuleController::getModule()) had no permission check of its own, unlike its sibling save endpoint which already required core.edit on com_modules.module.{id}. Reaching it via GET /index.php?option=com_ajax&p=/module&id=<id> returned that module's title, full params JSON (which can include API keys, raw HTML or JS, and other sensitive module configuration) and rendered content, for any module id on the site, published or unpublished. Published as CVE-2026-77997 by the Joomla CNA on 25 August 2026, CVSS 4.0 base 5.1 Medium (AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N). The affected range on the record is 1.0.0 to 5.0.41. Exploitation requires an authenticated user who already holds core.edit on com_templates. YOOtheme's CheckUserPermission middleware runs on every route the framework dispatches and aborts with 403 (or redirects a guest to the login page) unless that permission is held, and the /module route does not opt out of it as the newsletter and image routes do. This is therefore a privilege boundary crossed sideways rather than an anonymous read: a user trusted to edit templates could read the configuration of any module on the site without holding any com_modules permission at all. Fixed in 5.0.42, which adds an explicit $user->authorise('core.edit', 'com_modules.module.{id}') check to getModule(). Confirmed by diffing the 5.0.41 and 5.0.42 packages and tracing the full request path. Note that YOOtheme Pro installs as both a template and a system plugin, and both report the element yootheme, so a single site normally shows two rows for this. Updating YOOtheme Pro updates both together. Update YOOtheme Pro to 5.0.42 or later through the Joomla Extensions manager, or download it from your YOOtheme account.
Affected versions: ≥ 5.0.41 and < 5.0.42
Full advisory: www.cve.org
Other vulnerabilities in YOOtheme Pro
Updating for CVE-2026-77997 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extension.
YOOtheme Pro
Latest safe version: 5.0.42
- CVE-2026-76613 High, before 4.5.34
- CVE-2026-75115 High, before 4.5.34
References
- CVE-2026-77997 on cve.org (the official CVE record)
- CVE-2026-77997 in the NIST National Vulnerability Database
- cve.org/CVERecord?id=CVE-2026-76613
CVE-2026-77997 questions
Which versions are affected by CVE-2026-77997?
CVE-2026-77997 is covered by 2 rules: YOOtheme Pro before 4.5.34; YOOtheme Pro from 5.0.41 up to but not including 5.0.42.
How do I fix CVE-2026-77997?
It depends on the extension and release line your site runs. For YOOtheme Pro before 4.5.34: update YOOtheme Pro to 4.5.34 or later. For YOOtheme Pro from 5.0.41 up to but not including 5.0.42: update YOOtheme Pro to 5.0.42 or later.
How severe is CVE-2026-77997?
Joomla CNA scores it 5.1 (Medium) under CVSS 4.0. In plain terms: reachable across the internet, needs an account with elevated rights and nobody has to be tricked into anything.
Running an affected version on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.
Rules current as of 5 October 2026.