Joomla’s batch workflow-stage action (WorkflowBehaviorTrait::batchWorkflowStage) recorded an error when the user lacked core.admin permission but did not stop, so a backend user with batch access could still move content they are not allowed to manage to any workflow stage. Only sites with workflows enabled (off by default) are affected.
This vulnerability affects the following application versions:
- Joomla 4.0.0
- Joomla 4.0.1
- Joomla 4.0.2
- Joomla 4.0.3
- Joomla 4.0.4
- Joomla 4.0.5
- Joomla 4.0.6
- Joomla 4.1.0
- Joomla 4.1.1
- Joomla 4.1.2
- Joomla 4.1.3
- Joomla 4.1.4
- Joomla 4.1.5
- Joomla 4.2.0
- Joomla 4.2.1
- Joomla 4.2.2
- Joomla 4.2.3
- Joomla 4.2.4
- Joomla 4.2.5
- Joomla 4.2.6
- Joomla 4.2.7
- Joomla 4.2.8
- Joomla 4.2.9
- Joomla 4.3.0
- Joomla 4.3.1
- Joomla 4.3.2
- Joomla 4.3.3
- Joomla 4.3.4
- Joomla 4.4.0
- Joomla 4.4.1
- Joomla 4.4.2
- Joomla 4.4.3
- Joomla 4.4.4
- Joomla 4.4.5
- Joomla 4.4.6
- Joomla 4.4.7
- Joomla 4.4.8
- Joomla 4.4.9
- Joomla 4.4.10
- Joomla 4.4.11
- Joomla 4.4.12
- Joomla 4.4.13
- Joomla 4.4.14
- Joomla 5.0.0
- Joomla 5.0.1
- Joomla 5.0.2
- Joomla 5.0.3
- Joomla 5.1.0
- Joomla 5.1.1
- Joomla 5.1.2
- Joomla 5.1.3
- Joomla 5.1.4
- Joomla 5.2.0
- Joomla 5.2.1
- Joomla 5.2.2
- Joomla 5.2.3
- Joomla 5.2.4
- Joomla 5.2.5
- Joomla 5.2.6
- Joomla 5.3.0
- Joomla 5.3.1
- Joomla 5.3.2
- Joomla 5.3.3
- Joomla 5.3.4
- Joomla 5.4.0
- Joomla 5.4.1
- Joomla 5.4.2
- Joomla 5.4.3
- Joomla 5.4.4
- Joomla 5.4.5
- Joomla 5.4.6
- Joomla 5.4.7
- Joomla 5.4.8
- Joomla 6.0.0
- Joomla 6.0.1
- Joomla 6.0.2
- Joomla 6.0.3
- Joomla 6.0.4
- Joomla 6.1.0
- Joomla 6.1.1
- Joomla 6.1.2
- Joomla 6.1.3