CVE-2026-48956
Received Received - Intake

Improper Access Check in Joomla Frontend Module List

Publication date: 2026-07-07

Last updated on: 2026-07-07

Assigner: Joomla! Project

Description
An improper access check allows users to display a list of modules in the frontend.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-07
Last Modified
2026-07-07
Generated
2026-07-08
AI Q&A
2026-07-07
EPSS Evaluated
N/A
NVD
CVE-2026-48956
EUVD
EUVD-2026-42065

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
joomla joomla From 4.0.0 (inc) to 5.4.6 (inc)
joomla joomla From 5.4.0 (inc) to 5.4.6 (inc)
joomla joomla From 6.0.0 (inc) to 6.1.1 (inc)
joomla joomla 5.4.7
joomla joomla 6.1.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-48956 is a security vulnerability in the Joomla! content management system affecting versions 4.0.0 through 5.4.6 and 6.0.0 through 6.1.1.

The issue involves incorrect access control in the com_modules component, which allows users to improperly display a list of modules on the frontend.

This means that users who should not have permission can view module information that is normally restricted.

Impact Analysis

This vulnerability can lead to unauthorized users viewing a list of modules on the frontend of a Joomla! site.

While it does not allow modification or deletion, exposing module information could aid attackers in gathering information about the site's structure and potentially planning further attacks.

The severity is considered moderate, so it poses a meaningful risk that should be addressed by upgrading to patched versions.

Detection Guidance

This vulnerability involves incorrect access control in the Joomla! com_modules component, allowing users to display a list of modules on the frontend improperly.

Detection would involve verifying if unauthorized users can access the module listing on the frontend of the Joomla! CMS.

Since the vulnerability is specific to Joomla! versions 4.0.0 through 5.4.6 and 6.0.0 through 6.1.1, first identify the Joomla! version running on your system.

  • Check Joomla! version via the administrator backend or by running a command on the server such as: `php cli/joomla.php version`
  • Attempt to access the module list on the frontend without proper authorization to see if the list is displayed.

No specific detection commands are provided in the available resources.

Mitigation Strategies

The immediate mitigation step is to upgrade Joomla! to a fixed version.

  • Upgrade Joomla! to version 5.4.7 or later if you are on the 5.x branch.
  • Upgrade Joomla! to version 6.1.2 or later if you are on the 6.x branch.

These versions contain the fix for the incorrect access control vulnerability in the com_modules component.

Compliance Impact

The provided information does not specify how this vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48956. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart