CVE-2026-48898 HIGH

CVE-2026-48898: Joomla! Core - [20260513] - Privilege escalation through com_users batch task

Vendor Joomla! Project
Product Joomla! CMS
Weakness CWE-284
Published May 26, 2026
Last update May 27, 2026
View on NVD All CVEs

CVSS base score

8.2/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

An improper access check allows privilege escalation through the com_users batch task.

Explanation of Vulnerability in Simple Terms

02Summary

Joomla! CMS versions 4.0.0 through 5.4.5 contain an access control flaw that allows unauthenticated attackers to modify site data over the network. The vulnerability requires specific timing or conditions to exploit but does not require user interaction. Site administrators should update to a version newer than 5.4.5 as soon as a patch is available.

What an attacker can do

03Attacker Capabilities

Modify site data without authentication.

Potential impact on your site

04Site Impact

Unauthorized changes to site content, settings, or data by remote attackers.

Conditions required to exploit

05Prerequisites

Network access; no authentication or user interaction required.

Key dates

06Disclosure timeline

May 26, 2026 CVE published
May 27, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2024-2019 WP-DB-Table-Editor <= 1.8.4 - Missing Authorization to Authenticated(Contributor+) Database Access CVE-2026-35223 Joomla! Core - [20260508] - Improper access check in com_config webservice endpoints CVE-2020-36838 Facebook Chat Plugin <= 1.5 - Missing Capabilities Check CVE-2024-9503 Maintenance & Coming Soon Redirect Animation <= 2.1.3 - Missing Authorization to Settings Update CVE-2024-13229 Rank Math SEO <= 1.0.235 - Missing Authorization to Authenticated (Contributor+) Arbitrary Schema Deletion