---
title: "[20190603] - Core - ACL hardening of com_joomlaupdate"
description: "We help designers, developers, hobbyists and business owners get the most out of the Joomla CMS.  Join us at our free monthly meetups, and let us help you with your Joomla projects."
url: "https://www.joomlalondon.co.uk/official-joomla-announcements/20190603-core-acl-hardening-of-com-joomlaupdate"
date: "2026-09-09T17:14:24+00:00"
language: "en-GB"
---

#  \[20190603\] - Core - ACL hardening of com\_joomlaupdate

- **Project:** Joomla!
- **SubProject:** CMS
- **Impact:** Low
- **Severity:** Low
- **Versions:** 3.8.13 through 3.9.6
- **Exploit type:** Incorrect Access Control
- **Reported Date:** 2019-April-10
- **Fixed Date:** 2019-June-11
- **CVE Number:** [CVE-2019-12764](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12764)

### Description

The update server URL of com\_joomlaupdate can be manipulated by non Super-Admin users.

### Affected Installs

Joomla! CMS versions 3.8.13 through 3.9.6

### Solution

Upgrade to version 3.9.7

### Contact

The JSST at the [Joomla! Security Centre](https://developer.joomla.org/security-centre.html "Contact the JSST").

Read more  [http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/\_M8Ux7hoaTM/785-20190603-core-acl-hardening-of-com-joomlaupdate.html](http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/_M8Ux7hoaTM/785-20190603-core-acl-hardening-of-com-joomlaupdate.html "[20190603] - Core - ACL hardening of com_joomlaupd")

## Schema

```json
{ "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Start", "item": "https://www.joomlalondon.co.uk" }, { "@type": "ListItem", "position": 2, "name": "Official Joomla! Announcements", "item": "https://www.joomlalondon.co.uk/official-joomla-announcements" }, { "@type": "ListItem", "position": 3, "name": "[20190603] - Core - ACL hardening of com_joomlaupdate", "item": "https://www.joomlalondon.co.uk/official-joomla-announcements/20190603-core-acl-hardening-of-com-joomlaupdate" } ] }
```