CVE-2026-48957 MEDIUM

CVE-2026-48957: Joomla! Core - [20260711] - Incorrect Access Control in com_privacy webservice endpoints

Vendor Joomla! Project
Product Joomla! CMS
Weakness CWE-284
Published July 7, 2026
Last update July 8, 2026
View on NVD All CVEs

CVSS base score

6.4/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H

What the vulnerability does

01Description

An improper access check allows unauthorized users to access com_privacy datasets.

Explanation of Vulnerability in Simple Terms

02Summary

Joomla! CMS versions 4.0.0 through 5.4.6 contain an access control flaw that allows high-privilege users to perform unauthorized actions beyond their intended scope. The vulnerability affects multiple security functions within the core system. Site administrators should update to a version newer than 5.4.6 to remediate this issue.

What an attacker can do

03Attacker Capabilities

A high-privilege user can perform actions outside their authorized scope, potentially modifying site configuration or data.

Potential impact on your site

04Site Impact

Compromised admin accounts could be abused to alter site settings, content, or user permissions beyond their intended role.

Conditions required to exploit

05Prerequisites

Attacker must have high-level administrative or privileged account access to the Joomla installation.

Key dates

06Disclosure timeline

July 7, 2026 CVE published
July 8, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2025-12182 Qi Blocks <= 1.4.3 - Missing Authorization to Arbitrary Attachment Resize CVE-2026-2592 Zarinpal Gateway for WooCommerce <= 5.0.16 - Improper Access Control to Payment Status Update CVE-2024-13693 Enfold <= 6.0.9 - Missing Authorization to Sensitive Information Disclosure in avia-export-class.php CVE-2024-10937 Related Posts, Inline Related Posts, Contextual Related Posts, Related Content By PickPlugins <= 2.0.58 - Sensitive Information Exposure CVE-2026-35223 Joomla! Core - [20260508] - Improper access check in com_config webservice endpoints