CVE-2026-48941

CVE-2026-48941: Joomla Extension - getk2.org - Unauthenticated folder delete in K2 extension for Joomla < 2.26

Vendor Getk2.Org

Product K2 extension for Joomla

Weakness CWE-862 · Missing authorization

Published June 25, 2026

Last update June 28, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The K2 frontend `item.checkin` task accepts an unauthenticated `sigProFolder` query parameter and uses it directly to address a `JFolder::delete()` call under `/media/k2/galleries/`

Explanation of Vulnerability in Simple Terms

02Summary

The K2 extension for Joomla contains a missing authorization vulnerability that allows attackers to perform unauthorized actions. The affected versions range from 1.0-2.26, though the exact patched version is unknown. Site administrators should update to a version newer than the affected range when available. The vulnerability stems from insufficient access control checks in the extension's code.

What an attacker can do

03Attacker Capabilities

Perform actions without proper authorization checks in the K2 extension.

Potential impact on your site

04Site Impact

Unauthorized users may access or modify K2 content or settings depending on the specific vulnerability.

Conditions required to exploit

05Prerequisites

Access to the Joomla site; specific attack vector details are unavailable.

Key dates

06Disclosure timeline

June 25, 2026 CVE published

June 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-48941 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html AskarLabs — CWE-862 write-up Missing Authorization

Related vulnerabilities