Detect CVE-2026-56290: Joomlack Page Builder Improper Access Control Exploitation in IBM QRadar
Detects exploitation attempts targeting CVE-2026-56290, an improper access control vulnerability (CWE-284) in Joomlack Page Builder for Joomla. This KEV-listed vulnerability allows unauthorized access to restricted Page Builder functionality, potentially enabling content manipulation, privilege escalation, or unauthorized administrative actions on affected Joomla installations.
MITRE ATT&CK
QRadar Detection Query
SELECT sourceip, destinationip, URL, username, eventcount, starttime
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Apache HTTP Server', 'Microsoft IIS', 'Nginx')
AND URL ILIKE '%option=com_ckpagebuilder%'
AND (URL ILIKE '%task=save%' OR URL ILIKE '%task=edit%' OR URL ILIKE '%task=delete%' OR URL ILIKE '%task=publish%' OR URL ILIKE '%task=apply%')
AND username IN ('', 'anonymous', '-')
LAST 7 DAYS
GROUP BY sourceip, destinationip, URL, username, starttime
HAVING eventcount > 2
ORDER BY starttime DESCQRadar AQL query detecting unauthenticated or anonymous requests to Joomlack Page Builder with modification task parameters, indicating potential access control bypass exploitation.
Data Sources
Required Tables
False Positives & Tuning
- Guest user sessions that have legitimate read-only access being misclassified as anonymous
- Load balancers stripping authentication headers before reaching the logging layer
- Cached page requests replayed by CDN infrastructure without user context
- Monitoring agents performing health checks against page builder endpoints
Other platforms for CVE-2026-56290
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1CVE-2026-56290 Unauthenticated Page Builder Access Probe
Expected signal: Web server access log entry showing GET request to com_ckpagebuilder with task=edit parameter. Vulnerable systems return HTTP 200 with page builder editor content; patched systems return HTTP 403 or redirect to login.
- Test 2CVE-2026-56290 Unauthorized Page Content Save Attempt
Expected signal: POST request to com_ckpagebuilder with task=page.save in web server access logs. Database write operation to Joomla content tables if exploitation succeeds. Joomla action log entry (if plugin enabled) showing content modification without proper user authorization.
- Test 3CVE-2026-56290 Page Builder Admin Function Access as Low-Privilege User
Expected signal: Authentication request followed by access to Page Builder publish endpoint in web server logs. Joomla session table entry for subscriber_test user making requests to com_ckpagebuilder administrative tasks. Action log entries (if enabled) showing publish action attributed to subscriber-level user.
References (4)
- https://www.joomlack.fr/en/joomla-extensions/page-builder-ck
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-56290
Unlock Pro Content
Get the full detection package for CVE-2026-56290 including response playbook, investigation guide, and atomic red team tests.