Unscored CVE-2022-23795 EUVD-2022-28729GHSA-mpq5-6qpq-p78x

[20220303] - Core - User row are not bound to a authentication mechanism

Published Mar 30, 2022 · Updated Feb 25, 2026 · Assigned by Joomla

Vendor: Joomla! Project Product: Joomla! CMS Category: Web / CMS

Description

An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. A user row was not bound to a specific authentication mechanism which could under very special circumstances allow an account takeover.

Affected products

Vendor	Product	Affected	Fixed
Joomla! Project	Joomla! CMS	2.5.0-3.10.6 & 4.0.0-4.1.0	—

References

https://developer.joomla.org/security-centre/872-20220303-core-user-row-are-not-bound-to-a-authentication-mechanism.html vendor-advisory