Privilege Escalation in Joomla Category Webservice Endpoints

The com_categories API controller relied on the generic ApiController permission logic and never checked that the caller may manage the target extension, nor that the loaded category actually belongs to it. An authenticated user with only limited API access could therefore create, edit and delete categories of components they have no permissions for.

This vulnerability affects the following application versions:

• Joomla 4.0.0
• Joomla 4.0.1
• Joomla 4.0.2
• Joomla 4.0.3
• Joomla 4.0.4
• Joomla 4.0.5
• Joomla 4.0.6
• Joomla 4.1.0
• Joomla 4.1.1
• Joomla 4.1.2
• Joomla 4.1.3
• Joomla 4.1.4
• Joomla 4.1.5
• Joomla 4.2.0
• Joomla 4.2.1
• Joomla 4.2.2
• Joomla 4.2.3
• Joomla 4.2.4
• Joomla 4.2.5
• Joomla 4.2.6
• Joomla 4.2.7
• Joomla 4.2.8
• Joomla 4.2.9
• Joomla 4.3.0
• Joomla 4.3.1
• Joomla 4.3.2
• Joomla 4.3.3
• Joomla 4.3.4
• Joomla 4.4.0
• Joomla 4.4.1
• Joomla 4.4.2
• Joomla 4.4.3
• Joomla 4.4.4
• Joomla 4.4.5
• Joomla 4.4.6
• Joomla 4.4.7
• Joomla 4.4.8
• Joomla 4.4.9
• Joomla 4.4.10
• Joomla 4.4.11
• Joomla 4.4.12
• Joomla 4.4.13
• Joomla 4.4.14
• Joomla 5.0.0
• Joomla 5.0.1
• Joomla 5.0.2
• Joomla 5.0.3
• Joomla 5.1.0
• Joomla 5.1.1
• Joomla 5.1.2
• Joomla 5.1.3
• Joomla 5.1.4
• Joomla 5.2.0
• Joomla 5.2.1
• Joomla 5.2.2
• Joomla 5.2.3
• Joomla 5.2.4
• Joomla 5.2.5
• Joomla 5.2.6
• Joomla 5.3.0
• Joomla 5.3.1
• Joomla 5.3.2
• Joomla 5.3.3
• Joomla 5.3.4
• Joomla 5.4.0
• Joomla 5.4.1
• Joomla 5.4.2
• Joomla 5.4.3
• Joomla 5.4.4
• Joomla 5.4.5
• Joomla 5.4.6
• Joomla 5.4.7
• Joomla 6.0.0
• Joomla 6.0.1
• Joomla 6.0.2
• Joomla 6.0.3
• Joomla 6.0.4
• Joomla 6.1.0
• Joomla 6.1.1
• Joomla 6.1.2