CVE-2026-48904

CriticalCVSS 9.8

Published: 26/05/2026(UTC)Updated: 24/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

21th percentile - higher than 21% of all known CVEs

Vulnerability in Joomla! due to improper access control in the com_users group editing webservice endpoint. Allows privilege escalation.

Risk of privilege escalation by an authenticated user, potentially leading to unauthorized access to administrative functions.

Apply the patch provided by Joomla! for this vulnerability. Restrict access to webservice endpoints to trusted users only.

Original NVD description (English source)

An improper access check allows privelege escalation through the com_users group editing webservice endpoint.