CVE-2026-48901

Analyzed Analyzed - Analysis Complete

InputFilter Security Parameter Omission in Joomla

Publication date: 2026-05-26

Last updated on: 2026-05-28

Assigner: Joomla! Project

Description

The InputFilter::getInstance() method omitted a security sensitive parameter from the instance cache key.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-26

Last Modified

2026-05-28

Generated

2026-07-06

AI Q&A

2026-05-26

EPSS Evaluated

2026-07-05

NVD

CVE-2026-48901

EUVD

EUVD-2026-31871

Affected Vendors & Products

Vendor	Product	Version / Range
joomla	joomla!	From 4.0.0 (inc) to 5.4.6 (exc)
joomla	joomla!	From 6.0.0 (inc) to 6.1.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-524	The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.

Attack-Flow Graph

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Executive Summary

CVE-2026-48901 is a security vulnerability in Joomla! CMS versions 4.0.0 to 5.4.5 and 6.0.0 to 6.1.0. The issue lies in the InputFilter::getInstance() method, which incorrectly constructs cache keys by omitting a security-sensitive parameter.

Because of this omission, the cache key does not uniquely identify instances based on all relevant security parameters, potentially allowing attackers to bypass security measures or manipulate cached data.

Impact Analysis

This vulnerability could allow attackers to bypass security controls or manipulate cached data within the Joomla! CMS.

Such manipulation or bypass could lead to unauthorized access or unintended behavior in the application, although the severity, impact, and probability of exploitation are considered low.

To mitigate this risk, users should upgrade to Joomla! versions 5.4.6 or 6.1.1 where the issue has been fixed.

Mitigation Strategies

To mitigate the vulnerability CVE-2026-48901, users should upgrade their Joomla! CMS installations to versions 5.4.6 or 6.1.1 or later.

This update fixes the issue in the InputFilter::getInstance() method where a security-sensitive parameter was omitted from the cache key, preventing potential security bypass or cache manipulation.

Hi! I’m here to help you understand CVE-2026-48901. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70