Joomla! prior to 1.0.11 does not limit access to the Admin Popups functionality, which has unknown impact and attack vectors.
joomla joomla 1.0.9
joomla joomla