CVE-2026-48899
Improper Access Check Leads to Privilege Escalation in Joomla
Publication date: 2026-05-26
Last updated on: 2026-05-26
Assigner: Joomla! Project
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| joomla | cms | From 4.0.0 (inc) to 6.1.0 (inc) |
| joomla | cms | 5.4.6 |
| joomla | cms | 6.1.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-48899 is a security vulnerability in Joomla! CMS versions 4.0.0 through 5.4.5 and 6.0.0 through 6.1.0. It involves an improper access check that allows unauthorized users to escalate their privileges through the com_users batch task, specifically related to the installation of sample data.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the CVE-2026-48899 vulnerability, users should upgrade their Joomla! CMS installations to versions 5.4.6 or 6.1.1, where the issue has been fixed.
This vulnerability affects Joomla! CMS versions 4.0.0 through 5.4.5 and 6.0.0 through 6.1.0, so upgrading beyond these versions is critical to prevent unauthorized privilege escalation.
How can this vulnerability impact me? :
This vulnerability can allow unauthorized users to perform actions that should be restricted, such as installing sample data, by escalating their privileges. This could lead to unauthorized changes in the Joomla! CMS environment, potentially compromising the integrity and security of the website.