---
title: "[20181004] - Core - ACL Violation in com_users for the admin verification"
description: "We help designers, developers, hobbyists and business owners get the most out of the Joomla CMS.  Join us at our free monthly meetups, and let us help you with your Joomla projects."
url: "https://www.joomlalondon.co.uk/official-joomla-announcements/20181004-core-acl-violation-in-com-users-for-the-admin-verification"
date: "2026-09-09T14:29:56+00:00"
language: "en-GB"
---

#  \[20181004\] - Core - ACL Violation in com\_users for the admin verification

- **Project:** Joomla!
- **SubProject:** CMS
- **Impact:** Moderate
- **Severity:** Low
- **Versions:** 1.5.0 through 3.8.12
- **Exploit type:** ACL Violation
- **Reported Date:** 2017-December-27
- **Fixed Date:** 2018-October-02
- **CVE Number:** [CVE-2018-17855](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17855)

### Description

In case that an attacker gets access to the mail account of an user who can approve admin verifications in the registration process he can activate himself.

### Affected Installs

Joomla! CMS versions 1.5.0 through 3.8.12

### Solution

Upgrade to version 3.8.13

### Contact

The JSST at the [Joomla! Security Centre](https://developer.joomla.org/security-centre.html "Contact the JSST").

**Reported By:** Paul FreemanRead more  [http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/qGhSucxwoZo/754-20181004-core-acl-violation-in-com-users-for-the-admin-verification.html](http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/qGhSucxwoZo/754-20181004-core-acl-violation-in-com-users-for-the-admin-verification.html "[20181004] - Core - ACL Violation in com_users for")

## Schema

```json
{ "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Start", "item": "https://www.joomlalondon.co.uk" }, { "@type": "ListItem", "position": 2, "name": "Official Joomla! Announcements", "item": "https://www.joomlalondon.co.uk/official-joomla-announcements" }, { "@type": "ListItem", "position": 3, "name": "[20181004] - Core - ACL Violation in com_users for the admin verification", "item": "https://www.joomlalondon.co.uk/official-joomla-announcements/20181004-core-acl-violation-in-com-users-for-the-admin-verification" } ] }
```