CVE-2026-76609 in the Fabrik form-builder extension for Joomla is a critical unauthenticated IDOR vulnerability that the CVSS 6.9 score fundamentally mischaracterizes. The onUpdateComment endpoint fails at two independent security boundaries simultaneously: it accepts requests from the entire internet without any authentication check, and it performs no authorization verification before allowing modification of any comment record. This is not a single misconfiguration — it is a two-layer access control collapse that should be treated as a distinct vulnerability class because the exploitation topology is categorically different from standard IDOR, which at minimum requires an authenticated session.
The practical impact is severe precisely because no credentials, tooling, or special access are required. An attacker can programmatically modify any comment record in the system — which, given Fabrik is a form-builder, may include data types far beyond human-readable comments: procurement requests, patient records, approval workflows, or any table the extension has been configured to manage. The endpoint name creates a false semantic boundary that masks how generic and powerful the underlying operation actually is.
For defenders, the immediate priority is verifying whether your Fabrik deployment exposes the onUpdateComment endpoint and whether it resides at /index.php?option=com_fabrik&task=ajax. If the endpoint responds to unauthenticated requests with any JSON payload (including errors that reveal the endpoint exists), you are affected. The patch in Fabrik 4.7.2 adds both an authentication gate and a record-level authorization check — verify you have applied it, but also audit for other AJAX endpoints in the extension that may share the same failure mode. The pattern here is a known class: AJAX callbacks in CMS extensions execute outside the normal authentication lifecycle, and developers frequently assume inherited protection that never materializes. Treat every AJAX endpoint as a standalone entry point requiring explicit auth assertions, not middleware inheritance. The CVSS score does not reflect the horizontal blast radius across unrelated deployments running the same extension — mass exploitation requires nothing more than a curl request, making this effectively critical in any multi-tenant or widely-deployed context.