CVE-2026-48900 MEDIUM

CVE-2026-48900: Joomla! Core - [20260516] - Incorrect Access Control in com_scheduler

Vendor Joomla! Project
Product Joomla! CMS
Weakness CWE-284
Published May 26, 2026
Last update May 27, 2026
View on NVD All CVEs

CVSS base score

6.4/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:H/SI:H/SA:H

What the vulnerability does

01Description

An improper access check allowed low privileged users to edit the task types of existing scheduler tasks.

Explanation of Vulnerability in Simple Terms

02Summary

Joomla! CMS versions 4.1.0 through 5.4.5 contain an access control flaw that allows high-privilege users to modify site configuration beyond their intended permissions. The vulnerability affects multiple system functions due to improper authorization checks. Site administrators should update to a patched version as soon as available.

What an attacker can do

03Attacker Capabilities

A high-privilege user can modify site settings and configuration they should not have access to.

Potential impact on your site

04Site Impact

Unauthorized changes to site configuration, settings, or data by privileged users with restricted roles.

Conditions required to exploit

05Prerequisites

Attacker must have high-level administrative privileges on the Joomla site.

Key dates

06Disclosure timeline

May 26, 2026 CVE published
May 27, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2024-10124 Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce <= 1.1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation CVE-2025-11163 SmartCrawl SEO checker, analyzer & optimizer <= 3.14.3 - Missing Authorization to Plugin Settings Update CVE-2025-25225 Extension - hikashop.com - Privilege escalation vulnerability Hikashop component version 1.0.0 - 5.1.3 for Joomla CVE-2026-21627 Extension - tassos.gr - SQL injection and Unauthenticated File Read in Novarain/Tassos Framework v4.10.14 – v6.0.37 for Joomla CVE-2025-12884 Advanced Ads – Ad Manager & AdSense <= 2.0.14 - Missing Authorization to Authenticated (Subscriber+) Ad Placements Update