Alert GCSA-26117 - Aggiornamento di sicurezza per Joomla!

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

******************************************************************

   alert ID: GCSA-26117
       data: 08 luglio 2026
     titolo: Aggiornamento di sicurezza per Joomla!

******************************************************************

:: Descrizione del problema

   Sono state rilasciate nuova versioni del CMS Joomla!
   con le quali vengono corrette varie vulnerabilita' di sicurezza.

   [20260701] - Core - Incorrect Access Control in com_media webservice endpoints
   [20260702] - Core - Incorrect Access Control in com_contact vcf download
   [20260703] - Core - XSS in MFA method management
   [20260704] - Core - XSS in com_templates
   [20260705] - Core - XSS in various modalreturn layouts
   [20260706] - Core - XSS in com_installer
   [20260707] - Core - XSS in the generic image output layout
   [20260708] - Core - XSS through language overrides
   [20260709] - Core - Incorrect Access Control in com_workflow
   [20260710] - Core - Incorrect Access Control in com_modules
   [20260711] - Core - Incorrect Access Control in com_privacy webservice endpoints
   [20260712] - Core - Incorrect Access Control in com_fields webservice endpoints

   Maggiori dettagli sono disponibili alla sezione "Riferimenti".


:: Software interessato

   Joomla! versioni dalla 3.0.0 alla 5.4.6
   Joomla! versioni dalla 6.0.0 alla 6.1.1


:: Impatto

   Bypass delle funzionalita' di sicurezza (SFB)
   Acquisizione di privilegi piu' elevati (EoP)
   Cross-Site Scripting (XSS)


:: Soluzioni

   Aggiornare alle versioni piu' recenti (5.4.7, 6.1.2)

   https://downloads.joomla.org/
   https://downloads.joomla.org/latest
   https://downloads.joomla.org/cms/joomla5/5-4-7
   https://downloads.joomla.org/cms/joomla6/


:: Riferimenti

   Joomla! Release News
   https://www.joomla.org/announcements/release-news/5955-joomla-6-1-2-5-4-7-security-bugfix-release.html

   Joomla! Security Announcements
   https://developer.joomla.org/security-centre/

   Mitre CVE
   https://www.cve.org/CVERecord?id=CVE-2026-48947
   https://www.cve.org/CVERecord?id=CVE-2026-48948
   https://www.cve.org/CVERecord?id=CVE-2026-48949
   https://www.cve.org/CVERecord?id=CVE-2026-48950
   https://www.cve.org/CVERecord?id=CVE-2026-48951
   https://www.cve.org/CVERecord?id=CVE-2026-48952
   https://www.cve.org/CVERecord?id=CVE-2026-48953
   https://www.cve.org/CVERecord?id=CVE-2026-48954
   https://www.cve.org/CVERecord?id=CVE-2026-48955
   https://www.cve.org/CVERecord?id=CVE-2026-48956
   https://www.cve.org/CVERecord?id=CVE-2026-48957
   https://www.cve.org/CVERecord?id=CVE-2026-48958


GARR CERT Security Alert - subscribe/unsubscribe:
http://www.cert.garr.it/alert/ricevi-gli-alert-di-cert

-----BEGIN PGP SIGNATURE-----

iF0EAREIAB0WIQTGpdiR5MqstacBGHbBnEyTZRJgQgUCak4KzgAKCRDBnEyTZRJg
QvViAKCGQe75Mm2ZDoRPSHpZL0DfitcODwCfc8Qnki50J+PcpS370BRdSdSmGjQ=
=pn2A
-----END PGP SIGNATURE-----