CVE-2026-48947 MEDIUM

CVE-2026-48947: Joomla! Core - [20260701] - Incorrect Access Control in com_media webservice endpoints

Vendor Joomla! Project
Product Joomla! CMS
Weakness CWE-284
Published July 7, 2026
Last update July 8, 2026
View on NVD All CVEs

CVSS base score

6.4/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H

What the vulnerability does

01Description

An improper access check allows privileged users to overwrite media files without editing permissions.

Explanation of Vulnerability in Simple Terms

02Summary

Joomla! CMS versions 4.1.0 through 5.4.6 contain an access control flaw that allows high-privilege users to modify site integrity and availability settings they should not have access to. The vulnerability requires an authenticated administrator account and does not expose confidential data. Site owners should update to a version newer than 5.4.6 when available.

What an attacker can do

03Attacker Capabilities

A high-privilege user can modify site integrity and availability settings beyond their authorized scope.

Potential impact on your site

04Site Impact

Unauthorized configuration changes by admins could degrade site stability or alter critical settings.

Conditions required to exploit

05Prerequisites

Attacker must have an authenticated administrator account with high privileges.

Key dates

06Disclosure timeline

July 7, 2026 CVE published
July 8, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2024-12294 Last Viewed Posts by WPBeginner <= 1.0.1 - Unauthenticated Sensitive Information Exposure CVE-2026-48907 Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5 CVE-2024-0972 BuddyPress Members Only <= 3.4.8 - Improper Access Control to Sensitive Information Exposure via REST API CVE-2025-14977 Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 4.2.4 - Insecure Direct Object Reference to PayPal Account Takeover and Sensitive Information Disclosure CVE-2026-48899 Joomla! Core - [20260515] - Incorrect Access Control in sample data plugins