Unscored CVE-2021-26037 EUVD-2021-12860GHSA-2qqv-xp5x-f5wf

[20210703] - Core - Lack of enforced session termination

Published Jul 7, 2021 · Updated Feb 25, 2026 · Assigned by Joomla

Vendor: Joomla! Project Product: Joomla! CMS Category: Web / CMS

Description

An issue was discovered in Joomla! 2.5.0 through 3.9.27. CMS functions did not properly termine existing user sessions when a user's password was changed or the user was blocked.

Affected products

Vendor	Product	Affected	Fixed
Joomla! Project	Joomla! CMS	2.5.0-3.9.27	—

References

https://developer.joomla.org/security-centre/858-20210703-core-lack-of-enforced-session-termination.html vendor-advisory