CVE-2026-48899 MEDIUM

CVE-2026-48899: Joomla! Core - [20260515] - Incorrect Access Control in sample data plugins

Vendor Joomla! Project
Product Joomla! CMS
Weakness CWE-284
Published May 26, 2026
Last update May 27, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

An improper access check allows privilege escalation through the com_users batch task.

Explanation of Vulnerability in Simple Terms

02Summary

Joomla! CMS versions 4.0.0 through 5.4.5 contain an access control flaw that allows authenticated users with low privileges to access resources or perform actions they should not be able to. The vulnerability requires a valid user account but no additional user interaction. Site administrators should update to a version newer than 5.4.5 to remediate this issue.

What an attacker can do

03Attacker Capabilities

An authenticated user can access or modify resources beyond their assigned permission level.

Potential impact on your site

04Site Impact

Authenticated users may view or alter content, settings, or data they should not have access to.

Conditions required to exploit

05Prerequisites

Attacker must have a valid Joomla user account with low-level privileges.

Key dates

06Disclosure timeline

May 26, 2026 CVE published
May 27, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2023-6491 Strong Testimonials <= 3.1.12 - Authenticated(Contributor+) Improper Authorization to Views Modification CVE-2026-48898 Joomla! Core - [20260513] - Privilege escalation through com_users batch task CVE-2024-11868 LearnPress – WordPress LMS Plugin <= 4.2.7.3 - Course Material Sensitive Information Exposure via REST API CVE-2026-21627 Extension - tassos.gr - SQL injection and Unauthenticated File Read in Novarain/Tassos Framework v4.10.14 – v6.0.37 for Joomla CVE-2026-0748 Access bypass in Drupal 7 i18n_node translation UI