CVE-2026-90907

The Joomla! Core software versions 1.5.0-5.4.8 and 6.0.0-6.1.3 are vulnerable to unauthorized user account creation. The root cause is a failure in the profile.save controller , which does not verify the login state of a user. This allows unauthenticated attackers to create guest-level users on w...