Insufficient state checks lead to a vector that allows to bypass 2FA checks.

An improper access check allows privilege escalation through the com_users batch task.

An improper access check allows privelege escalation through the com_users group editing webservice endpoint.

An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. A user row was not bound to a specific authentication mechanism which could under very special circumstances allow an account takeover.

Insufficient state checks lead to a vector that allows to bypass 2FA checks.