Joomla! CMS CVE-2026-25901

Exploitation requires the attacker to be authenticated with high-privilege access in Joomla! CMS (PR:H - typically Super Administrator or Administrator role with access to com_associations). The multilingual associations component must be in use on the target installation; sites that have not configured multilingual content have a reduced attack surface. A second condition is passive user interaction (UI:P): a separate victim with at least administrator-level access must open or interact with the maliciously crafted association record for the XSS payload to execute. Exploitation is therefore bounded by the need for an insider threat or a pre-compromised admin account, plus a victim admin performing normal administrative tasks. This is not a default-configuration unauthenticated attack. Limiting factors are the high-privilege prerequisite and the required victim interaction, both of which significantly reduce opportunistic exploitation probability beyond what the base CVSS score alone might suggest.

Despite a CVSS 4.0 base score of 6.9 (medium), real-world exploitation risk is low. The PR:H requirement means an attacker must already hold high-privileged access within Joomla before injecting a payload - this is not an unauthenticated threat. UI:P further demands that a separate victim interact with the malicious content, introducing a social-engineering dependency. EPSS at 0.04% (13th percentile) corroborates low exploitation likelihood in the wild. SSVC signals reinforce this: exploitation status is none, the attack is not automatable, and technical impact is only partial. The VC:H sub-score is notable - session theft against another administrator would be high-value - but it is bounded by the SC:N / SI:N / SA:N scope, meaning cross-system impact is not expected. Taken together, this vulnerability is a realistic but non-urgent internal escalation risk: a malicious or compromised high-privilege Joomla user could pivot to compromise other admin accounts, but mass exploitation is not a realistic near-term threat. No public exploit code has been identified and CISA has not added this to KEV.

A high-privilege Joomla administrator (or an attacker who has compromised such an account) navigates to the multilingual associations component and saves a content item containing a crafted XSS payload in an unescaped field. When a second administrator reviews or interacts with that association entry - for example, during routine content audit or translation workflow - the injected script executes in their browser, harvesting their session cookie and transmitting it to an attacker-controlled endpoint. No public exploit code exists at time of analysis, but the attack is conceptually straightforward for anyone with access to the affected UI.