CVE-2026-48948 MEDIUM

CVE-2026-48948: Joomla! Core - [20260702] - Incorrect Access Control in com_contact vcf download

Vendor Joomla! Project
Product Joomla! CMS
Weakness CWE-284
Published July 7, 2026
Last update July 8, 2026
View on NVD All CVEs

CVSS base score

6.4/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H

What the vulnerability does

01Description

An improper access check allows user to download vcard exports of com_contact contacts that are inaccessible.

Explanation of Vulnerability in Simple Terms

02Summary

Joomla CMS versions 3.0.0 through 5.4.6 contain an access control flaw that allows high-privilege users to perform unauthorized actions beyond their intended scope. The vulnerability affects multiple security functions within the CMS. Site administrators should update to a version newer than 5.4.6 to remediate this issue.

What an attacker can do

03Attacker Capabilities

A high-privilege user can perform actions outside their authorized scope, potentially affecting site integrity and data.

Potential impact on your site

04Site Impact

Privileged user accounts (admins, super-admins) may exceed their intended permissions, risking unauthorized modifications to site content or configuration.

Conditions required to exploit

05Prerequisites

Attacker must have high-level administrative or privileged account access to the Joomla installation.

Key dates

06Disclosure timeline

July 7, 2026 CVE published
July 8, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-48898 Joomla! Core - [20260513] - Privilege escalation through com_users batch task CVE-2026-0844 Simple User Registration <= 6.7 - Authenticated (Subscriber+) Privilege Escalation via profile_save_field CVE-2024-10393 Tutor LMS <= 2.7.6 - User Registration Setting Bypass to Unauthorized User Registration CVE-2026-2592 Zarinpal Gateway for WooCommerce <= 5.0.16 - Improper Access Control to Payment Status Update CVE-2024-13855 Prime Addons for Elementor <= 2.0.1 - Authenticated (Contributor+) Insecure Direct Object Reference via pae_global_block Shortcode