CVE-2026-48955 MEDIUM

CVE-2026-48955: Joomla! Core - [20260709] - Incorrect Access Control in com_workflow

Vendor Joomla! Project
Product Joomla! CMS
Weakness CWE-284
Published July 7, 2026
Last update July 8, 2026
View on NVD All CVEs

CVSS base score

6.4/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H

What the vulnerability does

01Description

An improper access check allows unauthorized users to access workflow stage and transition information.

Explanation of Vulnerability in Simple Terms

02Summary

Joomla! CMS versions 6.0.0 through 6.1.1 contain an access control flaw that allows high-privilege users to perform unauthorized actions beyond their intended scope. The vulnerability affects multiple security functions within the CMS. Site administrators should update to a patched version as soon as it becomes available.

What an attacker can do

03Attacker Capabilities

A high-privilege user can perform actions outside their authorized scope, potentially affecting site integrity and settings.

Potential impact on your site

04Site Impact

Privileged user accounts may be able to modify site settings, content, or configurations beyond their intended permissions.

Conditions required to exploit

05Prerequisites

Attacker must have high-level administrative or privileged account access to the Joomla installation.

Key dates

06Disclosure timeline

July 7, 2026 CVE published
July 8, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2024-13240 Open Social - Moderately critical - Access bypass - SA-CONTRIB-2024-004 CVE-2024-13229 Rank Math SEO <= 1.0.235 - Missing Authorization to Authenticated (Contributor+) Arbitrary Schema Deletion CVE-2024-13430 Page Builder: Pagelayer – Drag and Drop website builder <= 1.9.8 - Authenticated (Contributor+) Private Post Disclosure in pagelayer_builder_posts_shortcode CVE-2024-13854 Education Addon for Elementor <= 1.3.1 - Authenticated (Contributor+) Insecure Direct Object Reference via naedu_elementor_template Shortcode CVE-2026-48904 Joomla! Core - [20260514] - Privilege escalation through com_users webservice endpoints