Three Critical Joomla Fabrik Vulnerabilities: Exposure and Response

Why the three issues belong in one review

Fabrik is a Joomla extension for forms, lists, and database-backed applications. The three vulnerabilities reach different server-side functions, but all are described as remotely reachable without authentication and affect releases before Fabrik 4.7.3. CVE-2026-76604 concerns code execution through a PHP form element. CVE-2026-76571 concerns a list-filter condition entering a WHERE clause. CVE-2026-76602 concerns an unvalidated ordering value entering an ORDER BY clause. Administrators should map public forms and lists together while keeping the code-execution and database-query paths distinct.

Scope and conditions

The official records describe Fabrik versions before 4.7.3 as affected. The Joomla core version alone does not answer the question; every site’s installed Fabrik version must be verified. Managed-service and multisite environments should compare extension inventories, deployment history, and actual files. Public reachability of the PHP element, list filter, or sorting feature changes immediate exposure, but it does not replace the update.

• CVE-2026-76604: unauthenticated remote code execution through a PHP form element
• CVE-2026-76571: unauthenticated SQL injection through the list-filter condition
• CVE-2026-76602: unauthenticated SQL injection through the list model’s order value

How the paths differ

For CVE-2026-76604, the boundary is the PHP form element’s server-side evaluation path. An unauthenticated route into code evaluation can affect the application and the host under the web-server account’s permissions. Identify public forms containing the element, the events or AJAX handlers they use, and the files and secrets available to the web process. Defensive configuration review and log preservation are safer than reproducing an exploit.

CVE-2026-76571 involves a condition value being concatenated into a WHERE clause. CVE-2026-76602 involves an order value being used in an ORDER BY clause without validation. Because the parameters differ, a temporary control aimed at one request field is not coverage for both issues. Review unusual filter or ordering values, repeated list requests, database errors, unexpected response sizes, and broad reads. Database least privilege can limit reach, but it does not replace patching.

Update and validation order

1. Inventory Fabrik versions and installation paths on every Joomla site; prioritize releases earlier than 4.7.3.
2. Map public menus, forms, lists, and AJAX or API routes connected to Fabrik.
3. While an update is pending, restrict unnecessary public forms and lists and retain reverse-proxy or WAF logs.
4. Update to Fabrik 4.7.3 or later, clear caches, and test form submission, filtering, sorting, and role-based views.
5. Review the pre-update exposure window across web, PHP, Joomla administration, and database logs.

A file replacement is not the final validation. Fabrik often supports business workflows and stored data, so representative functions need testing after the update. Confirm the backup and database recovery point before deployment, record rollback conditions, and keep unnecessary public paths restricted if a regression occurs.

Post-update review

The RCE and SQL injection paths leave different signals. For the PHP element, focus on unexpected PHP errors, new or modified web-root files, unusual child processes, and configuration-file access. For SQL injection, focus on repeated filter and order requests, database errors, unusually broad reads, and changes in response size or duration. Correlate time, route, session, and administrative changes instead of relying on one IP address or one blocked string.

If suspicious code execution or database access appears, do not close the case merely because Fabrik is patched. Preserve evidence, isolate the host when appropriate, rotate exposed secrets in a controlled order, and evaluate data impact under incident response. Record installed version, exposure map, update time, functional validation, and log-review scope for every site.