Improper Access Check in Joomla Contact VCard Export

Compliance Impact

The vulnerability allows unauthorized users to download vCard exports of contacts that should be inaccessible, indicating an improper access control issue.

Such unauthorized access to contact information could potentially lead to non-compliance with data protection regulations like GDPR or HIPAA, which require strict controls over personal and sensitive data access.

However, the provided information does not explicitly state the impact on compliance with these standards.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-48948 is a security vulnerability in the Joomla! content management system that affects versions 3.0.0 through 5.4.5 and 6.0.0 through 6.1.1.

The issue is caused by incorrect access control in the com_contact component, which allows users to download vCard exports of contacts that they should not have permission to access.

This means that unauthorized users can obtain contact information that is meant to be restricted.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure of contact information by allowing users to download vCard exports of contacts they are not authorized to access.

Such unauthorized access could compromise privacy and potentially expose sensitive contact details.

However, the severity is classified as low with a low probability of exploitation.

To mitigate the risk, users should upgrade Joomla! to versions 5.4.7 or 6.1.2 or later where the issue is fixed.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate CVE-2026-48948, users should upgrade their Joomla! CMS installations to the patched versions 5.4.7 or 6.1.2 where the incorrect access control issue in the com_contact component has been fixed.

This vulnerability affects versions 3.0.0 through 5.4.5 and 6.0.0 through 6.1.1, so ensuring your system is updated beyond these versions will reduce the risk of unauthorized vCard exports.

Useful 0 Not Useful 0