CVE-2026-76599highCWE-284

CVE-2026-76599: high-severity vulnerability in fabrikar.com Fabrik extension for Joomla

Joomla Extension - fabrikar.com - Unauthenticated database table list and table-prefix disclosure in Fabrik < 4.7.2

Published · Updated

Follow this CVE+ Monitor Fabrik extension for Joomla

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7epss 0.4%
Joomla Extension - fabrikar.com - Unauthenticated database table list and table-prefix disclosure in Fabrik < 4.7.2 - The ajax_tables method of the elements model allows listings of arbitrary database tables including columns.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
fabrikar.com · Fabrik extension for Joomla
Related CVEs — fabrikar.com Fabrik extension for Joomla

In the same product, most dangerous first.

CVE-2026-66915CRITICALJoomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik < 4.7.2EPSS 0.8%CVE-2026-67282CRITICALJoomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik < 4.6.8EPSS 0.8%CVE-2026-76605CRITICALJoomla Extension - fabrikar.com - Remote code execution via image element in Fabrik < 4.7.2EPSS 0.7%CVE-2026-76604CRITICALJoomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik < 4.7.2EPSS 0.7%CVE-2026-76606CRITICALJoomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.2EPSS 0.5%CVE-2026-76598HIGHJoomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjax_getFolders in Fabrik < 4.7.2EPSS 0.5%