Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| tassos.gr | Advanced Custom Fields extension for Joomla | unaffected |
|
|||||||||
| tassos.gr | Smile Pack extension for Joomla | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
| Link | Providers |
|---|---|
| https://www.tassos.gr/ |
|
Thu, 05 Nov 2026 19:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
Thu, 05 Nov 2026 18:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Joomla Extension - tassos.gr - File deletion through improper access control in Advanced Custom Fields extension 2.8.13-2.8.15, 3.1.4-3.1.8 and Smile Pack 1.2.7-1.2.9, 2.1.2-2.1.6 - Anyone could delete images in the Gallery folders, including images on published articles and modules, without logging in. In ACF 3.1.7 and 3.1.8, users could also see, remove or save each other’s unsaved uploads. | |
| Title | Joomla Extension - tassos.gr - File deletion through improper access control in Advanced Custom Fields extension 2.8.13-2.8.15, 3.1.4-3.1.8 and Smile Pack 1.2.7-1.2.9, 2.1.2-2.1.6 | |
| Weaknesses | CWE-284 | |
| References |
| |
| Metrics |
cvssV4_0
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: Joomla
Published:
Updated: 2026-11-05T19:17:19.015Z
Reserved: 2026-10-22T14:48:01.121Z
Link: CVE-2026-115451
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-05T19:17:09.963
Modified: 2026-11-05T19:17:09.963
Link: CVE-2026-115451
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-284
Improper Access Control