Joomla Extension jc_tables: Critical SQL Injection (CVE-2026-76570)

What CVE-2026-76570 is and who is affected

A critical vulnerability has been published in the Joomla extension joomcode jc_tables, catalogued as CVE-2026-76570 and rated CVSS 4.0 score 10 (CRITICAL) under the vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X. The underlying weakness is CWE-89, SQL injection.

According to the National Vulnerability Database (NVD) of NIST, the affected product is joomcode jc_tables up to 1.21.1 (excluded). The NVD description states that the front-end CRUD API controller performs no Joomla token validation and no authentication check on any task. Table names, column names and values are taken directly from request parameters and concatenated into SQL queries, which allows SQL injection for both read and write queries.

In plain terms: an attacker does not need an account, a session or a valid token. Any site exposing the vulnerable component to the internet is a candidate target. That includes small business websites, online shops and corporate portals built on Joomla where jc_tables has been installed for managing tabular content.

Why it is urgent

At the time of writing, CVE-2026-76570 does not appear in CISA's Known Exploited Vulnerabilities (KEV) catalogue, so there is no public confirmation that it is being exploited in real attacks. That is the only piece of good news, and it should not be read as reassurance.

A CVSS 4.0 score of 10 with a network attack vector, low attack complexity and no privileges or user interaction required is about as exposed as a flaw gets. SQL injection that supports write operations is not limited to data disclosure: it can allow an attacker to alter records, plant content or pivot towards further compromise of the hosting environment. Public technical analysis of the flaw has already been published by third parties, which lowers the barrier for opportunistic scanning.

Because the extension is distributed through the Joomla ecosystem, many site owners will not even know it is installed. Extensions are frequently added by a previous developer, bundled with a template, or left behind after a project ends, and they rarely appear in day-to-day maintenance checklists. That blind spot is exactly where this kind of issue lives.

What to do today

• Check whether jc_tables is installed and at which version. Review the extension list in the Joomla administrator panel and confirm the exact version. Anything below 1.21.1 falls inside the affected range as described by the NVD.
• Apply the fix indicated by the vendor. The NVD entry does not state a corrected version, so the reference point is the advisory published by joomcode.com. If no update is available yet, consider disabling or removing the extension until one is.
• Look for signs of intrusion. Review web server and application logs for unusual requests to the extension's front-end API endpoints, unexpected database changes, new administrator accounts, modified files or unfamiliar scheduled tasks.
• Reduce what is exposed to the internet. Restrict access to administrative and API paths by IP where possible, and make sure the site is not publishing endpoints that no visitor needs.
• Assume credentials may be at risk. If you find evidence of write access through SQL injection, rotate database and administrator credentials and take a fresh backup before making changes.

For Spanish companies, any incident involving personal data also triggers obligations under the GDPR, including assessment and, where applicable, notification to the supervisory authority. Speed of detection matters as much as speed of patching.

How a cybersecurity team such as ALMC's can help

Situations like this are rarely about a single extension. They are about knowing what is running on your infrastructure, which versions are in play and what is reachable from the internet. At ALMC we work with SMEs, online shops and companies across Lleida, Barcelona, Tarragona, Girona and the rest of Spain that run WordPress, PrestaShop or Joomla sites, often with their own servers and a small IT team.

Our cybersecurity work covers security audits and pentesting to find vulnerabilities before they are exploited, server hardening, monitoring and incident response, and ongoing maintenance and updating of WordPress, PrestaShop and Joomla installations. When a site has already been compromised, we also handle the repair of hacked websites: cleaning the intrusion, closing the entry point and restoring normal operation. In the case of CVE-2026-76570, the practical work is to confirm whether jc_tables is present, verify the version against the vendor's advisory, apply the corresponding update or mitigation, and review the site for any trace of unauthorised access.

If you are unsure whether this extension is part of your stack, or you simply do not have a reliable inventory of what your Joomla site is running, that gap is worth closing now rather than after an incident.

Related

• Abuse Shield

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.