Steps to reproduce the issue

Audit finding

To start an update, the user must select a confirmation checkbox before the Start update control becomes available.

The Start update control is implemented as a link that only appears disabled. It can still receive keyboard focus and be activated, but nothing happens.

The report notes that disabled controls have an exception from the 4.5:1 text-contrast requirement. Because this control is not actually disabled, that exception does not apply.

The report suggests adding aria-disabled="true" and tabindex="-1" while the control is unavailable, removing both attributes when it becomes available. Alternatively, it suggests setting the link to inert while disabled to prevent all interaction.

User impact

Screen-reader and keyboard users may encounter the Start update control and believe it is available because it remains focusable and clickable.

Activating it produces no response, which can be confusing. Users may not realize that they must first select the confirmation checkbox.

The disabled-looking appearance may also make the control difficult to see. Because it is not programmatically disabled, its low contrast cannot be justified by the disabled-control exception.

This can make the update workflow slower and may leave users uncertain why the control does not work.

Remediation plan

Make the unavailable state programmatically and visually clear

• While the update cannot start, prevent the Start update control from receiving keyboard focus and activation
• Convey its unavailable state programmatically, such as with aria-disabled="true" and tabindex="-1", or by using inert
• Remove the unavailable-state attributes when the confirmation checkbox is selected and the control becomes available
• Ensure that the available control is operable with keyboard and pointer input
• Ensure that the state change is communicated to assistive technology where applicable
• Ensure that the control's appearance accurately reflects whether it is available
• If the control remains visible while unavailable, ensure its text contrast meets the applicable requirement because it is not genuinely disabled
• Preserve a visible focus indicator when the control becomes available
• Ensure the confirmation checkbox remains operable and correctly associated with its label
• Verify the behaviour after selecting and clearing the checkbox
• Do not rely on appearance alone to communicate the disabled state

Preconditions

• Use Joomla 6.2 with the Atum administrator template
• Sign in with an account permitted to access Joomla Update
• Use a test installation that displays an available update and the confirmation checkbox
• Record the exact Joomla build, browser name and version, operating system, viewport dimensions, and browser zoom
• Record the screen reader and browser combination if testing announcements
• Start at 100% browser zoom
• Use a disposable test installation
• Do not start an actual update during verification

Steps to reproduce

1. Open the Joomla administrator interface at the site's base URL followed by /administrator/
2. Open System → Update → Joomla
   • Alternatively, navigate to /administrator/index.php?option=com_joomlaupdate on the same installation
   • Record the navigation labels if they differ in the tested build
3. Locate the update confirmation checkbox and the Start update control
4. Leave the checkbox unselected
5. Move the pointer away from the control and keep keyboard focus elsewhere
6. Inspect the control using Developer Tools
7. Record its element type, href, aria-disabled value, tabindex, and any disabled or inert attribute
8. Use keyboard navigation to attempt to focus the control
9. Record whether it receives focus
10. Activate it with Enter or a pointer
11. Record whether any update process starts or whether nothing happens
12. Inspect and record the rendered text colour, background colour, opacity, and contrast ratio
13. Capture the unselected-checkbox state, focus state, and activation result
14. Select the confirmation checkbox
15. Recheck the control's attributes, focusability, activation behaviour, appearance, and contrast
16. Clear the checkbox and confirm that the unavailable state is restored
17. Do not start an update

Screen-reader verification

1. Use a screen reader with the browser combination being tested
2. Navigate to the confirmation checkbox and Start update control while the checkbox is unselected
3. Record how the screen reader announces the control
4. Record whether it communicates an unavailable or disabled state
5. Attempt to activate the control
6. Record whether the screen reader announces any state change
7. Select the confirmation checkbox
8. Record the updated announcement and activation behaviour
9. Clear the checkbox and repeat
10. Record the screen-reader name, version, browser, and operating system

Verification after remediation

1. With the confirmation checkbox unselected, confirm that Start update cannot receive keyboard focus or be activated
2. Confirm that its unavailable state is programmatically conveyed
3. Select the checkbox
4. Confirm that the control becomes focusable and operable
5. Confirm that its available state is programmatically conveyed
6. Confirm that the focus indicator is visible
7. Clear the checkbox and confirm that the unavailable state is restored
8. Record the final attributes, contrast, and interaction results

Version

6.2

Expected result

While the update confirmation checkbox is unselected, the Start update control cannot receive keyboard focus or be activated.

Its unavailable state is programmatically conveyed to assistive technology.

When the checkbox is selected, the control becomes focusable, operable, and clearly available.

Actual result

The Start update control is a link that only looks disabled.

While the confirmation checkbox is unselected, it can still receive keyboard focus and be clicked, but no update starts.

Because it is not genuinely disabled, its low contrast cannot rely on the disabled-control exception.

The current Joomla 6.2 build needs to be checked to establish whether the issue persists.

What device were you using? (eg, phone, laptop)

Desktop web

What web browser were you using? (eg, Chrome, Safari)

Chrome, Firefox, Edge, Safari

Assistive Technology?

VoiceOver, JAWS, NVDA

Additional Comments

The browser and assistive-technology entries above are carried forward from the original issue and do not represent a new verification of every combination against Joomla 6.2.

Development and Design are the responsibility tags in the original report.

The report's suggested aria-disabled="true" and tabindex="-1" approach is one possible remediation. Using inert is another. Choose and verify the approach that best fits the component and framework.

A control that only looks disabled must still meet the applicable contrast requirement because it remains interactive.

This issue is distinct from #48407. That issue concerns checkbox-boundary contrast; this issue concerns the unavailable state and behaviour of the Start update control.

MS2a is proposed for the shared disabled-control pattern, with MS3b covering the documented Joomla Update integration.