CVE-2026-48958
Received Received - Intake

Improper Access Check in Joomla CMS

Publication date: 2026-07-07

Last updated on: 2026-07-07

Assigner: Joomla! Project

Description
An improper access check allows unauthorized users to create custom fields via webservices endpoints.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-07
Last Modified
2026-07-07
Generated
2026-07-08
AI Q&A
2026-07-07
EPSS Evaluated
N/A
NVD
CVE-2026-48958
EUVD
EUVD-2026-42068

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
joomla cms From 4.0.0 (inc) to 5.4.6 (inc)
joomla cms From 6.0.0 (inc) to 6.1.1 (inc)
joomla cms 5.4.7
joomla cms 6.1.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-48958 is a security vulnerability in Joomla! CMS versions 4.0.0 through 5.4.6 and 6.0.0 through 6.1.1. It involves incorrect access control in the com_fields webservice endpoints, which allows unauthorized users to create custom fields.

This means that users who should not have permission can exploit the vulnerability to add custom fields via webservice calls.

Impact Analysis

The vulnerability can lead to unauthorized creation of custom fields in Joomla! CMS, which may affect the integrity and security of the system.

Although classified as having a moderate impact and low probability of exploitation, it could potentially allow attackers to manipulate data structures or introduce unexpected behavior in the application.

Users are advised to upgrade to Joomla! versions 5.4.7 or 6.1.2 to mitigate this risk.

Mitigation Strategies

To mitigate the vulnerability CVE-2026-48958, users should upgrade their Joomla! CMS installations to versions 5.4.7 or 6.1.2 or later.

This update fixes the incorrect access control in the com_fields webservice endpoints that allowed unauthorized users to create custom fields.

Compliance Impact

The provided information does not specify how the vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48958. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart