Detect CVE-2026-56290: Joomlack Page Builder Improper Access Control Exploitation in Splunk
Detects exploitation attempts targeting CVE-2026-56290, an improper access control vulnerability (CWE-284) in Joomlack Page Builder for Joomla. This KEV-listed vulnerability allows unauthorized access to restricted Page Builder functionality, potentially enabling content manipulation, privilege escalation, or unauthorized administrative actions on affected Joomla installations.
MITRE ATT&CK
SPL Detection Query
index=web OR index=iis
| search uri_path IN ("*option=com_ckpagebuilder*", "*option=com_pagebuilder*")
| search uri_query IN ("*task=save*", "*task=edit*", "*task=delete*", "*task=publish*", "*task=apply*")
| eval is_admin_path=if(like(uri_path, "%administrator%"), 1, 0)
| eval suspicious=if(is_admin_path=1 AND NOT match(src_ip, "^10\.\.+|^192\.168\.\.+|^172\.(1[6-9]|2[0-9]|3[01])\."), 1, 0)
| stats count by src_ip, uri_path, uri_query, http_method, http_user_agent, suspicious
| where count > 1
| sort -countSplunk search detecting repeated requests to Joomlack Page Builder component with write-action task parameters, particularly from non-internal IP addresses accessing administrator endpoints.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legitimate content editors performing normal page builder operations
- Scheduled publishing tasks triggered by automation with proper session tokens
- Internal penetration testing or vulnerability scanning activities
- CDN or load balancer IP addresses masking legitimate administrative traffic
Other platforms for CVE-2026-56290
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1CVE-2026-56290 Unauthenticated Page Builder Access Probe
Expected signal: Web server access log entry showing GET request to com_ckpagebuilder with task=edit parameter. Vulnerable systems return HTTP 200 with page builder editor content; patched systems return HTTP 403 or redirect to login.
- Test 2CVE-2026-56290 Unauthorized Page Content Save Attempt
Expected signal: POST request to com_ckpagebuilder with task=page.save in web server access logs. Database write operation to Joomla content tables if exploitation succeeds. Joomla action log entry (if plugin enabled) showing content modification without proper user authorization.
- Test 3CVE-2026-56290 Page Builder Admin Function Access as Low-Privilege User
Expected signal: Authentication request followed by access to Page Builder publish endpoint in web server logs. Joomla session table entry for subscriber_test user making requests to com_ckpagebuilder administrative tasks. Action log entries (if enabled) showing publish action attributed to subscriber-level user.
References (4)
- https://www.joomlack.fr/en/joomla-extensions/page-builder-ck
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-56290
Unlock Pro Content
Get the full detection package for CVE-2026-56290 including response playbook, investigation guide, and atomic red team tests.