---
title: "Joomla CVE-2023-23752: Unauthenticated API Leaks DB Password"
url: https://erroneo.us/security/briefs/joomla-cve-2023-23752-api-public-config-leak/
description: "Joomla 4.0.0-4.2.7 exposed site config, including database credentials, via ?public=true API calls. Fixed in 4.2.8; Joomla 4 is now unsupported."
type: security-brief
section: "Security Digest"
date_published: 2023-02-16
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2023-23752"]
severity: "medium"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Joomla CVE-2023-23752: Unauthenticated API Leaks DB Password

**Verdict: Check exposure.** A medium score hides a database-password leak that has been mass-scanned since 2023; any site that ran Joomla 4.0.0-4.2.7 should be upgraded off the unsupported 4.x line and have its leaked secrets rotated.

- **Who must act:** Owners of Joomla sites that ran 4.0.0 through 4.2.7 on the public internet, and anyone still on the unsupported Joomla 4 line.
- **Who can relax:** Sites that were never on Joomla 4.0.0-4.2.7 (Joomla 3.x and 5.x+ are outside the affected range) and that run a supported release today.
- **Affected:** Joomla! CMS 4.0.0 through 4.2.7
- **Fixed:** Joomla! 4.2.8 (Feb 16, 2023); Joomla 4 is no longer supported (last release 4.4.14, Sep 30, 2025); move to a supported major version
- **CVEs:** CVE-2023-23752
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Find the version of every Joomla site: grep -m1 '<version>' administrator/manifests/files/joomla.xml.
2. Upgrade any 4.x site to a supported Joomla major version; 4.x no longer receives fixes.
3. If a site ever ran 4.0.0-4.2.7 publicly, change the database password and the secret in configuration.php, and reset Super User passwords.
4. Make sure MySQL or MariaDB listens only on localhost or a private network, never the internet.
5. Audit Super User accounts, installed extensions and template files for changes you did not make.

### How to check if you are affected

- grep web access logs for /api/index.php/v1/config/application or /api/index.php/v1/users with public=true; a 200 response on a vulnerable version means the data left.
- Check database server logs for logins to the Joomla database user from addresses other than the web server.
- List Super Users and recently installed extensions, and diff template index.php files against a clean copy for injected PHP.

## What happened

On February 16, 2023, the Joomla project released 4.2.8 to fix CVE-2023-23752, an improper access check in the web services API, per its [security announcement](https://developer.joomla.org/security-centre/894-20230201-core-improper-access-check-in-webservice-endpoints.html). Zewei Zhang of NSFOCUS TIANJI Lab reported it on February 13. Joomla rated it high severity. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2023-23752) carries a CISA-ADP score of CVSS 3.1 5.3, because on paper it is only information disclosure.

In practice the leaked information is the worst kind. Adding `?public=true` to an API route skipped authentication. As [VulnCheck](https://www.vulncheck.com/blog/joomla-for-rce) showed, `/api/index.php/v1/config/application?public=true` returns the site configuration, including the MySQL host, user, password and database name in plaintext. `/api/index.php/v1/users?public=true` returns usernames, email addresses and group membership, including Super Users. If the database accepts remote logins, an attacker can reset a Super User's password hash directly. Otherwise, a reused password or credential stuffing against the listed admins may work. A Super User can then edit a template or install a plugin to run PHP code.

Exploitation started fast. On March 8, 2023, the [SANS Internet Storm Center](https://isc.sans.edu/diary/29614) reported a sharp rise in honeypot hits on the config endpoint. VulnCheck counted many public exploits on GitHub, mostly built to grab database credentials. CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-23752) on January 8, 2024, with a January 29 deadline. The specific evidence behind that listing, nearly a year after the patch, was not disclosed as of Oct 23, 2026. Ransomware use is marked unknown.

## Who is affected

Joomla 4.0.0 through 4.2.7; no other versions are listed as affected. The fix shipped in 4.2.8. The whole Joomla 4 line is now unsupported: the official [downloads page](https://downloads.joomla.org/cms/joomla4) lists 4.4.14, released September 30, 2025, as the last 4.x release and says the series "is no longer supported."

## Do you really need to act?

Most active sites moved past 4.2.8 long ago. A month after disclosure, VulnCheck estimated about 1,500 servers were still vulnerable. Two problems remain. First, patching does not un-leak a password. If a site was exposed on a vulnerable version, assume its database credentials were collected, since scanning was automated within weeks. Second, a site still on any 4.x release gets no further fixes. Joomla's later KEV entries are in extensions, such as JCE (CVE-2026-48907) and Page Builder CK (CVE-2026-56290), so keep extensions current too.

## What to do now

1. Check each site's version with `grep -m1 '<version>' administrator/manifests/files/joomla.xml`.
2. Upgrade any 4.x site to a supported Joomla major version.
3. If a site ran 4.0.0-4.2.7 publicly, change the database password and the `$secret` in `configuration.php`, and reset Super User passwords.
4. Bind MySQL or MariaDB to localhost or a private network.
5. Audit Super Users, installed extensions and template files.

## How to tell if you were hit

- Run `grep -E '/api/index.php/v1/(config/application|users)\?.*public=true' access.log*`. A 200 response on a vulnerable version means the data was returned.
- Check database logs for logins as the Joomla user from addresses other than the web server.
- Look for unknown Super Users, recently installed extensions and PHP added to template `index.php` files.

## Timeline

- Feb 13, 2023 — NSFOCUS reports the bug to Joomla.
- Feb 16, 2023 — Joomla 4.2.8 fixes CVE-2023-23752.
- Mar 8, 2023 — SANS ISC reports rising exploitation.
- Mar 23, 2023 — VulnCheck documents the path to code execution.
- Jan 8, 2024 — CISA adds CVE-2023-23752 to KEV.
- Sep 30, 2025 — Joomla 4.4.14, the last 4.x release.

## Sources

1. [Joomla! Security Centre — [20230201] Core - Improper access check in webservice endpoints](https://developer.joomla.org/security-centre/894-20230201-core-improper-access-check-in-webservice-endpoints.html)
2. [CVE record — CVE-2023-23752](https://www.cve.org/CVERecord?id=CVE-2023-23752)
3. [CISA — Known Exploited Vulnerabilities: CVE-2023-23752](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-23752)
4. [Joomla! Downloads — Joomla! 4 releases](https://downloads.joomla.org/cms/joomla4)
5. [VulnCheck — Joomla! CVE-2023-23752 to Code Execution](https://www.vulncheck.com/blog/joomla-for-rce)
6. [SANS Internet Storm Center — Increase in exploits agains Joomla (CVE-2023-23752)](https://isc.sans.edu/diary/29614)

---
Source page: https://erroneo.us/security/briefs/joomla-cve-2023-23752-api-public-config-leak/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt