CVE-2026-48904
Privilege Escalation in Joomla via com_users Group Editing
Publication date: 2026-05-26
Last updated on: 2026-05-26
Assigner: Joomla! Project
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| joomla | joomla | From 4.0.0 (inc) to 5.4.5 (inc) |
| joomla | joomla | From 6.0.0 (inc) to 6.1.0 (inc) |
| joomla | joomla | 5.4.6 |
| joomla | joomla | 6.1.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthorized privilege escalation through an improper access check in Joomla!'s com_users group editing webservice endpoint. Such unauthorized access can lead to potential data breaches or unauthorized data modifications, which may impact compliance with data protection regulations like GDPR and HIPAA that require strict access controls and protection of sensitive information.
Organizations using affected Joomla! versions should upgrade to the fixed versions (5.4.6 and 6.1.1) to mitigate the risk and maintain compliance with these standards.
Can you explain this vulnerability to me?
CVE-2026-48904 is a privilege escalation vulnerability in Joomla! CMS versions 4.0.0 through 5.4.5 and 6.0.0 through 6.1.0. It occurs due to an improper access check in the com_users group editing webservice endpoint, which allows unauthorized users to escalate their privileges.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to escalate their privileges within a Joomla! CMS installation without proper authorization. This means an attacker could gain higher-level access than intended, potentially leading to unauthorized changes, data exposure, or control over the affected system.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the CVE-2026-48904 vulnerability, users should upgrade Joomla! CMS to versions 5.4.6 or 6.1.1 or later, where the issue has been fixed.
This vulnerability arises from an improper access check in the com_users group editing webservice endpoint, allowing unauthorized privilege escalation.