Security
Quix 6.4.0 fixes unauthorised article access
ThemeXpert’s Quix Page Builder 6.4.0 fixes an access-control flaw that allowed unauthenticated visitors to retrieve restricted Joomla article content.
Research published by mySites.guru says the issue affects Quix versions below 6.4.0. The flaw is an unauthenticated authorisation failure in Quix’s front-end AJAX handling: published articles could be fetched by ID without checking whether the visitor was permitted to read them. The impact is read-only disclosure; it does not allow changes or code execution.
mySites.guru rates the issue 6.9, Medium, using CVSS 4.0. ThemeXpert has not assigned a severity or provided an affected-version range, and no CVE identifier has been issued. The report does not state that the flaw is being exploited.
- Update Quix, including Quix Pro, to
6.4.0. - Clear both Quix and Joomla caches after upgrading.
- Review restricted articles and change any sensitive information that may have been exposed before the update.
Sites using Registered, Special or custom access levels should prioritise the update. The report says there is no workaround that replaces upgrading.
Originally reported by mySites.guru.