---
id: CVE-2026-76570
title: >-
  Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and
  write queries in JCTables  1.21.1 - The front-end CRUD API controller performs
  no Joomla token validation and no authentication check on any task
summary: >-
  Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and
  write queries in JCTables  1.21.1 - The front-end CRUD API controller performs
  no Joomla token validation and no authentication check on any task. Table
  names, c…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-89
vendor: joomcode
product: jc_tables
affected:
  - jc_tables < 1.21.1
patched:
  - jc_tables 1.21.1
published: '2026-09-30'
updated: '2026-10-06'
sourceUpdated: '2026-10-06T17:19:45.533'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-76570'
references:
  - url: 'https://www.joomcode.com/'
    label: security@joomla.org
  - url: 'https://www.vulncheck.com/blog/jctables-unauthenticated-sql-rw-to-rce'
    label: security@joomla.org
tags:
  - nvd
  - exploit-available
  - cve.org
epss: 0.0046
epssPercentile: 0.39735
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/murrez/CVE-2026-76570'
  checkedAt: '2026-10-27T19:12:36.419Z'
exploitAvailable: true
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-09-30T14:59:27.938634Z'
scores:
  nvd: 9.1
  cna: 10
ingestedAt: '2026-09-30T15:07:05.377Z'
---

## Overview

Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables  1.21.1 - The front-end CRUD API controller performs no Joomla token validation and no authentication check on any task. Table names, column names, and values are taken directly from request parameters and concatenated into SQL queries, allowing SQLi for reading and writing queries.

## Affected

- `jc_tables < 1.21.1`

## Remediation

Upgrade past the affected range:

- `jc_tables 1.21.1`