Joomla 6.2 Updates the Editor, Email Authentication, and Security Alerts

Joomla 6.2 was released on October 13, 2026. According to Habr, the release improves the TinyMCE content editor, adds OAuth 2.0 authentication for SMTP, and makes extension security updates more visible. There are also changes for multilingual sites and integration developers. Before upgrading, site owners should check extension compatibility and make sure emails are being sent.

The editor and multilingual content

TinyMCE’s image and media insertion dialogs are now connected to Joomla’s media manager. You can select a file from the editor dialog without using a separate CMS button. The link dialog now lets you choose from internal sources: articles, contacts, menu items, and media. Third-party extensions can also use this mechanism through editor button plugins.

TinyMCE now has a “Read More” separator button. On an existing site, you may need to add it to the toolbar manually in the plugin settings. Another change concerns Joomla’s text filters: the editor now uses them by default. Previously saved settings on existing sites remain in effect, however. If HTML elements you need disappear after editing, I’d compare the TinyMCE settings with the text filtering rules for the user group.

Partially translated extensions now have a fallback language chain. When a string is missing from the selected translation, Joomla can look for it in a designated fallback language; strings that already have translations are not replaced. The relationship can be set in the language component’s settings or in the language pack, with the component setting taking priority. If no relationship is configured, the site behaves as before.

You can now assign CSS classes separately to the image and its wrapper for both an article’s intro image and full article image. Subcategory images have also been added to the standard category lists and blogs. Where the built-in styling is enough, this may remove the need for a custom layout override.

Email, updates, and changes for developers

Joomla 6.2 introduces OAuth 2.0 authentication for SMTP, including for Microsoft 365 and Google Workspace. SMTP and OAuth 2.0 as the authentication method are configured in Joomla’s Global Configuration, under mail settings on the “Server” tab. The administrator separately selects the corporate SMTP account the site will use to send messages. The CMS obtains a refresh token so it can request access tokens later. Email delivery affects, for example, messages from forms, registration notifications, and order details.

Extension developers can now indicate through the update server that a release addresses a security issue and specify its severity. Joomla displays a marker in the update list and a notification on the main dashboard. If a site owner has missed several versions, the system uses the highest severity among them: a later routine release does not hide an earlier vulnerability fix. But the extension developer has to provide the necessary information for the marker to appear. The news about vulnerabilities fixed in All in One SEO is another reminder of why it matters to keep track of extension updates.

The articles REST API now has separate introtext and fulltext fields. The previous combined text field is still available but has been deprecated, with removal planned for Joomla 8. It makes sense to build new integrations around the separate fields and check existing integrations for references to text.

Other changes for developers include a form field that gets its options from a PHP enum and the ability to build Joomla core JavaScript and CSS as separate assets. The count of available articles in categories has also been fixed: if all articles are scheduled for future publication or their display period has ended, they should no longer make the category appear populated.

What to check before upgrading your site

I’d suggest site owners start with the workflows they rely on, not the list of new buttons. Check emails from forms and order notifications, especially if you use corporate SMTP. Then open an article in the editor: try inserting a file and an internal link, find the “Read More” button, and make sure your usual markup is preserved.

On a multilingual site, it’s worth checking where extension translations are missing individual strings and deciding whether a fallback language chain would help. Developers should check their extensions for compatibility with 6.2, the reporting of security fixes, and their use of REST API fields. Site owners should check the compatibility of their installed extensions separately: new core features do not, by themselves, confirm it.

My take: email and clear update alerts matter

For my small shop, the biggest changes here aren’t about image styling but about email and update information. If an order email doesn’t go out, that’s already a problem for the customer. And a security-fix marker helps me see more quickly which of several updates needs attention. I wouldn’t treat it as a substitute for checking the extension itself: its developer still has to provide the information.

I like it when a ready-made platform takes care of everyday tasks like these: there are fewer reasons to look for a specialist for every setting, and it’s easier to plan expenses. Still, I wouldn’t upgrade blindly. I’d check the extensions and the main steps a customer takes on the site first, then assess the editor’s new conveniences.

Sources

Where the news comes from. The text is a retelling in the author’s own words; the facts come from the source, the opinion is the author’s.

1. Вышла Joomla 6.2. Что нового? habr.com

About the author

Mila Petkova

home goods shop owner

I run a small online store and update the catalog, promotions, and descriptions myself. Right now I’m figuring out how to tie SEO work to actual orders, not just traffic.

All posts by the author