Joomla CVE-2023-23752: Unauthenticated API Leaks DB Password

What to do

1. Find the version of every Joomla site: grep -m1 '<version>' administrator/manifests/files/joomla.xml.
2. Upgrade any 4.x site to a supported Joomla major version; 4.x no longer receives fixes.
3. If a site ever ran 4.0.0-4.2.7 publicly, change the database password and the secret in configuration.php, and reset Super User passwords.
4. Make sure MySQL or MariaDB listens only on localhost or a private network, never the internet.
5. Audit Super User accounts, installed extensions and template files for changes you did not make.

How to check if you are affected or compromised

• grep web access logs for /api/index.php/v1/config/application or /api/index.php/v1/users with public=true; a 200 response on a vulnerable version means the data left.
• Check database server logs for logins to the Joomla database user from addresses other than the web server.
• List Super Users and recently installed extensions, and diff template index.php files against a clean copy for injected PHP.

What happened#

On February 16, 2023, the Joomla project released 4.2.8 to fix CVE-2023-23752, an improper access check in the web services API, per its security announcement. Zewei Zhang of NSFOCUS TIANJI Lab reported it on February 13. Joomla rated it high severity. The CVE record carries a CISA-ADP score of CVSS 3.1 5.3, because on paper it is only information disclosure.

In practice the leaked information is the worst kind. Adding ?public=true to an API route skipped authentication. As VulnCheck showed, /api/index.php/v1/config/application?public=true returns the site configuration, including the MySQL host, user, password and database name in plaintext. /api/index.php/v1/users?public=true returns usernames, email addresses and group membership, including Super Users. If the database accepts remote logins, an attacker can reset a Super User's password hash directly. Otherwise, a reused password or credential stuffing against the listed admins may work. A Super User can then edit a template or install a plugin to run PHP code.

Exploitation started fast. On March 8, 2023, the SANS Internet Storm Center reported a sharp rise in honeypot hits on the config endpoint. VulnCheck counted many public exploits on GitHub, mostly built to grab database credentials. CISA added the CVE to the KEV catalog on January 8, 2024, with a January 29 deadline. The specific evidence behind that listing, nearly a year after the patch, was not disclosed as of Oct 23, 2026. Ransomware use is marked unknown.

Who is affected#

Joomla 4.0.0 through 4.2.7; no other versions are listed as affected. The fix shipped in 4.2.8. The whole Joomla 4 line is now unsupported: the official downloads page lists 4.4.14, released September 30, 2025, as the last 4.x release and says the series "is no longer supported."

Do you really need to act?#

Most active sites moved past 4.2.8 long ago. A month after disclosure, VulnCheck estimated about 1,500 servers were still vulnerable. Two problems remain. First, patching does not un-leak a password. If a site was exposed on a vulnerable version, assume its database credentials were collected, since scanning was automated within weeks. Second, a site still on any 4.x release gets no further fixes. Joomla's later KEV entries are in extensions, such as JCE (CVE-2026-48907) and Page Builder CK (CVE-2026-56290), so keep extensions current too.

What to do now#

1. Check each site's version with grep -m1 '<version>' administrator/manifests/files/joomla.xml.
2. Upgrade any 4.x site to a supported Joomla major version.
3. If a site ran 4.0.0-4.2.7 publicly, change the database password and the $secret in configuration.php, and reset Super User passwords.
4. Bind MySQL or MariaDB to localhost or a private network.
5. Audit Super Users, installed extensions and template files.

How to tell if you were hit#

• Run grep -E '/api/index.php/v1/(config/application|users)\?.*public=true' access.log*. A 200 response on a vulnerable version means the data was returned.
• Check database logs for logins as the Joomla user from addresses other than the web server.
• Look for unknown Super Users, recently installed extensions and PHP added to template index.php files.

Timeline#

• Feb 13, 2023 — NSFOCUS reports the bug to Joomla.
• Feb 16, 2023 — Joomla 4.2.8 fixes CVE-2023-23752.
• Mar 8, 2023 — SANS ISC reports rising exploitation.
• Mar 23, 2023 — VulnCheck documents the path to code execution.
• Jan 8, 2024 — CISA adds CVE-2023-23752 to KEV.
• Sep 30, 2025 — Joomla 4.4.14, the last 4.x release.

Vulnerability records

• CVE-2023-23752 · KEV 2024-01-08 · An issue was discovered in Joomla! 4.0.0 through 4.2.7.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Joomla! Security Centre — [20230201] Core - Improper access check in webservice endpoints developer.joomla.org
2. CVE record — CVE-2023-23752 cve.org
3. CISA — Known Exploited Vulnerabilities: CVE-2023-23752 cisa.gov
4. Joomla! Downloads — Joomla! 4 releases downloads.joomla.org
5. VulnCheck — Joomla! CVE-2023-23752 to Code Execution vulncheck.com
6. SANS Internet Storm Center — Increase in exploits agains Joomla (CVE-2023-23752) isc.sans.edu