Detect CVE-2026-56290: Joomlack Page Builder Improper Access Control Exploitation in CrowdStrike LogScale
Detects exploitation attempts targeting CVE-2026-56290, an improper access control vulnerability (CWE-284) in Joomlack Page Builder for Joomla. This KEV-listed vulnerability allows unauthorized access to restricted Page Builder functionality, potentially enabling content manipulation, privilege escalation, or unauthorized administrative actions on affected Joomla installations.
MITRE ATT&CK
LogScale Detection Query
#event_simpleName=NetworkConnectIP4 OR #event_simpleName=HttpRequest
| filter HttpUrl=/option=com_ckpagebuilder/ AND HttpUrl=/(task=save|task=edit|task=delete|task=publish)/
| groupby([LocalAddressIP4, HttpUrl, HttpMethod, HttpStatus], function=count(1, as=RequestCount))
| filter RequestCount > 2
| sort RequestCount desc
| limit 100CrowdStrike Falcon LogScale query detecting network activity from endpoints making multiple requests to Joomlack Page Builder modification endpoints, which may indicate web shell deployment or post-exploitation activity.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate web application servers hosting Joomla making internal page builder API calls
- Managed service providers with authorized access performing content management operations
- DevOps pipelines deploying content updates through authenticated page builder sessions
- Browser-based rich text editors making multiple save requests during auto-save operations
Other platforms for CVE-2026-56290
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1CVE-2026-56290 Unauthenticated Page Builder Access Probe
Expected signal: Web server access log entry showing GET request to com_ckpagebuilder with task=edit parameter. Vulnerable systems return HTTP 200 with page builder editor content; patched systems return HTTP 403 or redirect to login.
- Test 2CVE-2026-56290 Unauthorized Page Content Save Attempt
Expected signal: POST request to com_ckpagebuilder with task=page.save in web server access logs. Database write operation to Joomla content tables if exploitation succeeds. Joomla action log entry (if plugin enabled) showing content modification without proper user authorization.
- Test 3CVE-2026-56290 Page Builder Admin Function Access as Low-Privilege User
Expected signal: Authentication request followed by access to Page Builder publish endpoint in web server logs. Joomla session table entry for subscriber_test user making requests to com_ckpagebuilder administrative tasks. Action log entries (if enabled) showing publish action attributed to subscriber-level user.
References (4)
- https://www.joomlack.fr/en/joomla-extensions/page-builder-ck
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-56290
Unlock Pro Content
Get the full detection package for CVE-2026-56290 including response playbook, investigation guide, and atomic red team tests.