CVE-2026-76602

CVE-2026-76602 is an unauthenticated SQL injection in the Fabrik extension for Joomla, targeting the ORDER BY parameter within list models. The vulnerability carries a CVSS 9.3 because the unsafe pattern lives in the data access layer itself — any endpoint that renders a sortable list view inherits the vulnerability, not just one misconfigured controller. The ORDER BY vector is the critical detail here. Unlike WHERE clauses, ORDER BY clauses cannot accept column names as prepared statement parameters — developers must either whitelist valid column identifiers or implement manual validation. When a framework exposes sorting through its list model architecture without providing that scaffolding, the unsafe pattern becomes the path of least resistance. This isn't developer negligence; it's architectural design that made injection inevitable. The unauthenticated access vector is what pushes this to critical severity. The vulnerability isn't gated behind login, meaning any anonymous user can craft SQL queries through the list interface to exfiltrate data from the database. The attack surface isn't one endpoint — it's every sorted list view in the extension. Fabrik has history here. Prior SQL injection CVEs in 2014 and 2015 targeted the same extension, suggesting a pattern of organizational knowledge loss rather than isolated mistakes. The recurrence across a decade indicates the root cause was never structurally addressed — patches fixed endpoints without rebuilding the data model layer to make validation mandatory. For defenders: audit every list model implementation in your Fabrik deployment and identify where user input flows into ORDER BY clauses. Implement column name whitelisting for any sorting parameter. If you're maintaining Fabrik, the fix isn't a single endpoint patch — it's refactoring the list model architecture to make input validation a structural requirement rather than an afterthought. The current maintainers inherited vulnerability debt from the original architecture; closing it requires rethinking how sorting parameters flow through the entire data access layer.

Reviewed through automated stages and approved by a human before publication.