{"id":"CVE-2018-17855","aliases":["EUVD-2018-9598","GHSA-7gxw-9g78-6pr9"],"status":"published","title":"An issue was discovered in Joomla! before 3.8.13. If an attacker gets access to the mail account...","description":"An issue was discovered in Joomla! before 3.8.13. If an attacker gets access to the mail account of an user who can approve admin verifications in the registration process, he can activate himself.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.019,"percentile":0.79809,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-269"],"published":"2018-10-09T21:00:00Z","modified":"2026-10-24T10:30:27Z","products":[{"vendor":"joomla","product":"joomla\\!"}],"references":[{"url":"http://www.securityfocus.com/bid/105559","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.securitytracker.com/id/1041914","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://developer.joomla.org/security-centre/754-20181004-core-acl-violation-in-com-users-for-the-admin-verification","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-17855"},{"url":"https://github.com/advisories/GHSA-7gxw-9g78-6pr9"}],"sources":{"cve":[{"id":"CVE-2018-17855","description":"An issue was discovered in Joomla! before 3.8.13. If an attacker gets access to the mail account of an user who can approve admin verifications in the registration process, he can activate himself.","status":"published","published":"2018-10-09T21:00:00Z","modified":"2024-08-05T10:54:10.847Z","updated_at":"2026-11-02T14:35:07.672841Z"}],"euvd":[{"id":"EUVD-2018-9598","description":"An issue was discovered in Joomla! before 3.8.13. If an attacker gets access to the mail account of an user who can approve admin verifications in the registration process, he can activate himself.","status":"published","published":"2018-10-09T21:00:00Z","modified":"2024-08-05T10:54:10Z","updated_at":"2026-11-03T02:39:37.709725Z"}],"ghsa":[{"id":"GHSA-7gxw-9g78-6pr9","title":"An issue was discovered in Joomla! before 3.8.13. If an attacker gets access to the mail account...","description":"An issue was discovered in Joomla! before 3.8.13. If an attacker gets access to the mail account of an user who can approve admin verifications in the registration process, he can activate himself.","status":"published","published":"2022-05-13T01:19:29Z","modified":"2023-02-01T05:05:49Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:50:16.912878Z"}],"nvd":[{"id":"CVE-2018-17855","description":"An issue was discovered in Joomla! before 3.8.13. If an attacker gets access to the mail account of an user who can approve admin verifications in the registration process, he can activate himself.","status":"published","published":"2018-10-09T21:29:00.543Z","modified":"2026-06-17T01:46:24.31Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:04:44.873741Z"}],"osv":[{"id":"CVE-2018-17855","description":"An issue was discovered in Joomla! before 3.8.13. If an attacker gets access to the mail account of an user who can approve admin verifications in the registration process, he can activate himself.","status":"published","published":"2018-10-09T21:29:00.543Z","modified":"2026-10-24T10:30:27.034326056Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:08.533609Z"}]}}