CVE-2026-48958 MEDIUM

CVE-2026-48958: Joomla! Core - [20260712] - Incorrect Access Control in com_fields webservice endpoints

Vendor Joomla! Project
Product Joomla! CMS
Weakness CWE-284
Published July 7, 2026
Last update July 8, 2026
View on NVD All CVEs

CVSS base score

6.4/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H

What the vulnerability does

01Description

An improper access check allows unauthorized users to create custom fields via webservices endpoints.

Explanation of Vulnerability in Simple Terms

02Summary

Joomla! CMS versions 4.0.0 through 5.4.6 contain an access control flaw that allows high-privileged users to modify site integrity and availability settings they should not have access to. The vulnerability requires an authenticated administrator account and does not expose confidential data. Site owners should update to a version newer than 5.4.6 when available.

What an attacker can do

03Attacker Capabilities

A high-privileged user can modify site integrity and availability settings beyond their authorized scope.

Potential impact on your site

04Site Impact

Unauthorized configuration changes by rogue admins could degrade site stability or modify critical settings.

Conditions required to exploit

05Prerequisites

Attacker must have high-level administrator privileges and network access to the Joomla admin panel.

Key dates

06Disclosure timeline

July 7, 2026 CVE published
July 8, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2024-5331 Breakdance <= 1.7.2 - Missing Authorization CVE-2026-21629 Joomla! Core - [20260301] - ACL hardening in com_ajax CVE-2026-48906 Extension - tassos.gr - Arbitrary File Deletion in Novarain/Tassos Framework < 6.1.0 for Joomla CVE-2024-13854 Education Addon for Elementor <= 1.3.1 - Authenticated (Contributor+) Insecure Direct Object Reference via naedu_elementor_template Shortcode CVE-2026-2356 User Registration & Membership <= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion