Security Audit

Shortly after the public release of Joomla! 1.0.7, a public discussion on the Joomla! forums reported that Poll data was visible or accessible despite being Unpublished - it was also mentioned that other unpublished core data may also be visible.

A quick check of Joomla! 1.0.7 by the Stability Team verified the vulnerability within the core Poll Component and also within other Core Components.

To properly investigate the matter and to ensure there weren’t other similar vulnerabilities within the Joomla! core code base a Security Audit was instituted.

As part of our moved towards increased transparency of `Core Operations` this Security Audit Report is being made available to the public in PDF format.

• Download `Joomla! Security Audit - A2 Broken Access Control [26 Feb 2006]`

The results of this audit make up a large bulk (30+) of the Security Fixes contained in 1.0.8
All Joomla! users are urged to read the report so they are aware of the nature of the vulnerabilities discovered and can understand why it is important to upgrade to 1.0.8.

3rd Party addon developers Must read the report to ensure they institute internal testing of their products, to ensure a similar vulnerability does not exist within their applications.

Future Audits

It is also our intention to conduct similar focused audits on the Joomla! codebase in the future. 

In fact we are currently working on another Security Audit conducted by Mathijs de Jong - one of our Quality & Testing Working Group members - currently restricted to internal viewing.

Once all issues in these Security Audits are resolved the reports will be made available to the community.