What is new in Joomla 6.2?
Joomla 6.2 is scheduled for 13 October 2026. The first beta appeared on 18 August 2026 and the 6.2 branch on GitHub is now well-populated, so we know quite a bit about what's coming.
Whereas 6.1 was mainly about spam protection and workflows, 6.2 has a clearer theme: tying up loose ends. The TinyMCE editor has been somewhat separate from Joomla for years, and updates never told you whether they were important or not. Those two things are now being addressed. Additionally, there's the usual stack of minor improvements you'll notice in day-to-day management.
Below I go through the main changes, grouped by component.
Note: Joomla 6.2 is still in beta at the time of writing. This overview is based on the pull requests that have been merged into the official 6.2.0 milestone. Things may still be added or dropped before the release.
The editor finally becomes part of Joomla
For most customers, this is the most noticeable improvement in 6.2. TinyMCE has always been somewhat beside Joomla rather than part of it. That's changing.
Media management is now in the image and media button
When you clicked the "Insert image" button in TinyMCE, you used to get a bare input field where you had to type or paste a URL yourself. Joomla's media manager was completely disconnected from it. If you wanted to use an image from your media library, you had to use the separate Joomla button below the editor, or manually copy the path.
In 6.2, TinyMCE's image and media buttons are directly connected to Joomla's media manager. You click the button and you simply see your own media library, including folders, uploads and the editing functions you're used to. For customers who maintain content themselves, this saves a lot of confusion: there's now only one place where images come from.
More info: PR #48043
A proper link picker instead of an empty text field
The same story applied to links. When you inserted a link via TinyMCE, you got an input field where you had to enter a URL yourself. Convenient if you happen to have that URL at hand, but for an internal link to an article or menu item, it always meant looking it up in a second tab first.
From now on, there's a button next to that input field called "Browse links". This opens a dialogue box where you can choose from articles, contacts, menu items and media. The nice thing is that this is set up as an extensible system: existing editors-xtd plugins can attach themselves to that selection list, so third-party extensions can participate here in the future.
More info: PR #48138
"Read more" becomes a proper button in the toolbar
Now that TinyMCE's media and link buttons are doing their job, there's increasingly less reason to keep that row of separate Joomla buttons below the editor. The first step in that direction: the "Read more" function has been rebuilt as a proper TinyMCE plugin with its own button in the toolbar.
It works functionally the same as before, with one improvement. If there was already a "Read more" in your article, you used to get a warning if you tried to place another one. Now the button is simply disabled in that case, which feels much more logical.
After updating: existing toolbar settings are deliberately not changed, so your own layout remains intact. If you want to use the new button, drag it to your toolbar yourself in the TinyMCE plugin, or reload one of the presets (Simple, Medium, Advanced). The latter will overwrite your current layout.
More info: PR #48236
The Joomla text filter is on by default
This is the kind of thing that comes up in every Joomla forum every week: "why does my script disappear from my article as soon as I save it?" The answer is usually that TinyMCE uses its own list of allowed HTML tags instead of Joomla's own text filter. This choice has existed since Joomla 3.6, but hardly anyone knows the setting exists, let alone where to find it.
In new Joomla 6.2 installations, the TinyMCE text filter parameter now defaults to the Joomla text filter. This makes the editor do what you would logically expect: it follows the permissions you have set per user group under Global Configuration → Text Filters, instead of using its own separate set of rules.
More info: PR #48041
Updates now tell you how urgent they are
Until now, a critical security update looked exactly the same in the update overview as a release with three text corrections. That's been fixed.
A security flag with five levels
From 6.2 onwards, extension developers can indicate in their update XML that a release is a security update and how serious the underlying issue is. This is done with a new tag in the update site:
The scale ranges from 0 to 4: 0 = none, 1 = low, 2 = medium, 3 = high and 4 = critical. In the overview under System → Updates you then see that indication for the relevant update.
For everyone maintaining sites, this is exactly the information that was missing so far. You can finally make an informed decision about whether an update needs to happen tonight or can easily wait until the scheduled maintenance window. The flip side: it only works if extension developers actually use that tag. So it will take a while before you see this widely in practice.
More info: PR #48127
The highest severity counts, not just the last one
A justified addition that was added shortly after. Suppose you're running version 1.0.0, a 1.0.1 with a "high" level issue has appeared, and meanwhile 1.0.3 is ready without a security notice. In the first setup, you wouldn't see any warning at all, because only the newest version was checked.
Joomla now looks at all releases since the version you're running and displays the highest severity it encounters. This way you'll never miss a security issue because a regular release has been made after the fix.
More info: PR #48190
The compatibility check looks ahead to Joomla 7
When upgrading to a new major version, Joomla checks whether the correct compat plugins are present. That check had the plugin names hard-coded in the code, so it looked at the wrong plugins on 6.x and had to be manually updated with each new major version. This has now been fixed by deriving the version numbers from Version::MAJOR_VERSION, both in the backend and in the CLI update command. Invisible work, but it will save hassle when jumping to Joomla 7.
More info: PR #47807 and PR #47814
Security and article previewing
Preview articles without logging into the frontend
Due to a potential security issue, this feature will not be added to Joomla 6.2
The preview button when editing an article was often unusable in practice. If you wanted to view an unpublished article, or an article with a restricted access level, you also had to be logged in on the frontend with an account that had the right permissions. In a backend-only work session, or in a browser where you're only logged in on the administration side, you simply got an error message or a blank page.
In 6.2, the preview button generates a link with a temporary, encrypted token. Whoever has that link can view the article, even if it's unpublished or behind an access level. Whoever doesn't have it can't get in. You set the validity period of such a token yourself, so an accidentally forwarded preview link doesn't keep working forever.
For submitting draft articles to a client, this is an excellent solution: you send a link, the client views it, and after the set period the access automatically expires.
More info: PR #48030
Reporting-Endpoints in the HTTP Headers plugin
The System – HTTP Headers plugin supports an additional header: Reporting-Endpoints. This allows you to specify an address where browsers automatically send reports, for example about blocked resources by your Content Security Policy or about expired certificates. You set it under "Force HTTP Headers" with a value like default="https://example.com/report". Particularly interesting if you're actively working with CSP on a site where it's taken seriously.
More info: PR #47294
