CVE-2026-48956 MEDIUM

CVE-2026-48956: Joomla! Core - [20260710] - Incorrect Access Control in com_modules

Vendor Joomla! Project
Product Joomla! CMS
Weakness CWE-284
Published July 7, 2026
Last update July 8, 2026
View on NVD All CVEs

CVSS base score

6.4/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H

What the vulnerability does

01Description

An improper access check allows users to display a list of modules in the frontend.

Explanation of Vulnerability in Simple Terms

02Summary

Joomla! CMS versions 4.0.0 through 5.4.6 contain an access control flaw that allows high-privileged users to perform unauthorized actions beyond their intended scope. The vulnerability affects multiple security functions within the CMS. Site administrators should update to a version newer than 5.4.6 to remediate this issue.

What an attacker can do

03Attacker Capabilities

A high-privileged user can perform actions outside their authorized scope, potentially modifying site integrity or availability.

Potential impact on your site

04Site Impact

Compromised admin accounts could alter site content, settings, or availability beyond their intended permissions.

Conditions required to exploit

05Prerequisites

Attacker must have high-level administrative privileges on the Joomla site; no user interaction required.

Key dates

06Disclosure timeline

July 7, 2026 CVE published
July 8, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2024-12370 WP Hotel Booking <= 2.1.5 - Missing Authorization CVE-2023-6491 Strong Testimonials <= 3.1.12 - Authenticated(Contributor+) Improper Authorization to Views Modification CVE-2026-48904 Joomla! Core - [20260514] - Privilege escalation through com_users webservice endpoints CVE-2024-10393 Tutor LMS <= 2.7.6 - User Registration Setting Bypass to Unauthorized User Registration CVE-2024-13854 Education Addon for Elementor <= 1.3.1 - Authenticated (Contributor+) Insecure Direct Object Reference via naedu_elementor_template Shortcode