CVE-2016-8870

8.1 highEPSS 81%

The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4, when registration has been disabled, allows remote attackers to create user accounts by leveraging failure to check the Allow User Registration configuration setting.

Severity

CVSS 3.0

8.1 high

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 81% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CWE: CWE-20
Published: 2016-11-04
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

joomla:joomla\!

References

http://www.rapid7.com/db/modules/auxiliary/admin/http/joomla_registration_privesc
http://www.securityfocus.com/bid/93876
http://www.securitytracker.com/id/1037107
http://www.securitytracker.com/id/1037108
https://blog.sucuri.net/2016/10/details-on-the-privilege-escalation-vulnerability-in-joomla.html

Check your stack JSON