What is new in Joomla 6.2?

Joomla 6.2 is scheduled for 13 October 2026. The first beta appeared on 18 August 2026 and the 6.2 branch on GitHub is now well populated, so we have a good idea of what's coming.

Whilst 6.1 was mainly about spam protection and workflows, 6.2 has a clearer thread: tying up loose ends. The TinyMCE editor has been half outside Joomla for years, and updates never told you whether they were important or not. These two things are now being addressed. In addition, there is the usual pile of minor improvements that you notice in daily administration.

Below I go through the main changes, grouped by component.

Note: At the time of writing, Joomla 6.2 is still in beta. This overview is based on pull requests that have been merged into the official 6.2.0 milestone. Something may still be added or removed before release.

The editor finally becomes part of Joomla

For most users, this is the most noticeable update of 6.2. TinyMCE was always somewhat alongside Joomla rather than part of it. That changes now.

Media management is now in the image and media button

When you clicked the "Insert Image" button in TinyMCE, you would get a bare input field where you had to type or paste a URL yourself. Joomla's media manager was completely disconnected from it. If you wanted to use an image from your media library, you had to use the separate Joomla button below the editor, or manually copy the path.

In 6.2, the image and media buttons in TinyMCE are directly linked to Joomla's media manager. You click the button and you simply see your own media library, including folders, uploads and the editing functions you're used to. For users who maintain content themselves, this eliminates a lot of confusion: there's only one place where images come from.

More info: PR #48043

A proper link picker instead of an empty text field

The same story applied to links. When you inserted a link via TinyMCE, you got an input field where you had to enter a URL yourself. Convenient if you happened to have that URL at hand, but for an internal link to an article or menu item, you always had to look it up in a second tab first.

From now on, there's a button next to that input field: "Browse links". This opens a dialog where you can choose from articles, contacts, menu items and media. The nice thing is that this is set up as an extensible system: existing editors-xtd plugins can hook themselves into that selection list, so third-party extensions can also use this in future.

More info: PR #48138

"Read more" becomes a proper button in the toolbar

Now that the media and link buttons in TinyMCE are working properly, there's less and less reason to have that row of separate Joomla buttons below the editor. The first step in that direction: the "Read more" function has been rebuilt as a proper TinyMCE plugin with its own button in the toolbar.

It works the same as before, with one improvement. If there was already a "Read more" in your article, you used to get a warning if you tried to add another one. Now the button is simply disabled in that case, which feels much more logical.

After updating: existing toolbar settings are deliberately not changed, so your custom layout remains intact. If you want to use the new button, drag it to your toolbar yourself in the TinyMCE plugin, or reload one of the presets (Simple, Medium, Advanced). The latter will overwrite your current layout.

More info: PR #48236

The Joomla text filter is enabled by default

This is one of those questions that appear in every Joomla forum every week: "why does my script disappear from my article as soon as I save it?" The answer is usually that TinyMCE uses its own list of allowed HTML tags instead of Joomla's own text filter. This choice has existed since Joomla 3.6, but almost no one knows the setting exists, let alone where to find it.

For new installations of Joomla 6.2, the TinyMCE parameter for the text filter is now set to the Joomla text filter by default. This makes the editor do what you would logically expect: it follows the permissions you've set per user group under Global Configuration → Text Filters, instead of applying its own separate rule set.

More info: PR #48041

Updates now tell you how urgent they are

Until now, a critical security update looked exactly the same in the update overview as a release with three text corrections. That's been fixed.

A security flag with five levels

Starting with 6.2, extension developers can indicate in their update XML that a release is a security update, and how serious the underlying issue is. This is done with a new tag in the update site: 4

The scale runs from 0 to 4: 0 = none, 1 = low, 2 = medium, 3 = high and 4 = critical. In the overview under System → Updates, you'll then see that indication next to the relevant update.

For anyone maintaining sites, this is exactly the information that was missing. You can finally make an informed decision about whether an update needs to happen tonight or can easily wait until the scheduled maintenance window. The catch: it only works if extension developers actually use that tag. So it will take a while before you see this widely in practice.

More info: PR #48127

The highest severity counts, not just the latest

A justified addition that was made shortly afterwards. Suppose: you're running version 1.0.0, a 1.0.1 with a "high" level issue has appeared, and meanwhile 1.0.3 is ready without security marking. In the first implementation, you would see no warning at all, because only the newest version was checked.

Joomla now looks at all releases since the version you're running, and displays the highest severity it finds among them. That way you never miss a security issue because a regular release came out after the fix.

More info: PR #48190

The compatibility check looks ahead to Joomla 7

When upgrading to a new major version, Joomla checks whether the correct compatibility plugins are present. That check had the plugin names hardcoded, which meant it looked for the wrong plugins on 6.x and had to be manually updated with each new major version. This has now been fixed by deriving the version numbers from Version::MAJOR_VERSION, both in the backend and in the CLI update command. Invisible work, but it will save hassle when moving to Joomla 7.

More info: PR #47807 and PR #47814

Security and article previews

Preview articles without logging into the frontend

The preview button when editing an article was often unusable in practice. If you wanted to view an unpublished article, or an article with a restricted access level, you also had to be logged in on the frontend with an account that had the right permissions. In a backend-only work session, or in a browser where you're only logged into the administration area, you simply got an error message or a blank page.

In 6.2, the preview button generates a link with a temporary, encrypted token. Whoever has that link can view the article, even if it's unpublished or behind an access level. Whoever doesn't have it can't get in. You set the validity period of such a token yourself, so an accidentally shared preview link doesn't keep working forever.

For submitting draft articles to a client, this is an excellent solution: you send a link, the client views it, and after the set period the access expires automatically.

More info: PR #48030

Reporting Endpoints in the HTTP Headers plugin

The System – HTTP Headers plugin supports an additional header: Reporting-Endpoints. This specifies an address where browsers automatically send reports, for example about blocked resources due to your Content Security Policy or about expired certificates. You set it under "Force HTTP Headers" with a value like default="https://example.com/report". Particularly interesting if you're actively working with CSP on a site where that's taken seriously.

__JM_PH_100