CVE-2026-76570

Name of the Vulnerable Software and Affected Versions JCTables version 1.21.1

Description An unauthenticated SQL injection exists in the front-end CRUD API controller. The component fails to perform Joomla token validation and authentication checks on any task. Table names, column names, and values are taken directly from request parameters and concatenated into SQL queries, enabling unauthorized read and write operations.

Recommendations Update JCTables to a version newer than 1.21.1.