Which versions of Joomla CMS are affected by CVE-2026-48897?

Joomla! CMS versions 4.0.0-5.4.5 and 6.0.0-6.1.0 contain a critical control gap that allows attackers to bypass multi-factor authentication protection, creating direct pathways to account compromise.

How to fix or mitigate CVE-2026-48897?

Within 24 hours: Conduct complete inventory of all Joomla! deployments and identify instances running versions 4.0.0-5.4.5 or 6.0.0-6.1.0. Within 7 days: Implement compensating controls including aggressive rate-limiting on authentication endpoints, IP-based access restrictions for administrative functions, and comprehensive audit logging of all authentication events. Within 30 days: Monitor Joomla! security advisories for patch availability; develop and begin execution of upgrade plan to move to patched versions.

Joomla CMS CVE-2026-48897

Q: What is the CVSS score of CVE-2026-48897?

CVE-2026-48897 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31883 HIGH

Improper Authentication (CWE-287)

2026-05-26 Joomla

GHSA-f2ph-7g59-rhf9

Authentication Bypass Joomla Cms

8.2

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 09:23 vuln.today

CVSS changed

May 26, 2026 - 17:22 NVD

8.2 (HIGH)

CVE Published

May 26, 2026 - 16:44 nvd

UNKNOWN (no severity yet)

CVE Published

May 26, 2026 - 16:44 nvd

HIGH 8.2

DescriptionCVE.org

Insufficient state checks lead to a vector that allows to bypass 2FA checks.

AnalysisAI

Authentication bypass in Joomla! CMS 4.0.0-5.4.5 and 6.0.0-6.1.0 allows remote attackers to circumvent multi-factor authentication (MFA) due to insufficient state validation during the login flow. The flaw, tracked as CVE-2026-48897 and reported by the Joomla! project, undermines the integrity protections expected from 2FA and could grant attackers access to accounts whose credentials are already known or guessable. EPSS probability is low (0.04%, 13th percentile) and there is no public exploit identified at time of analysis.

Technical ContextAI

The vulnerability sits in Joomla!'s core MFA implementation, which is part of the authentication pipeline for both the front-end and administrator interfaces. CWE-287 (Improper Authentication) here manifests as insufficient state checks: the application does not properly verify that the MFA challenge stage has been completed before transitioning a session to an authenticated state, meaning an attacker can manipulate the authentication state machine to skip the second factor. The CPE string cpe:2.3:a:joomla!_project:joomla!_cms:*:*:* confirms the issue is in the core CMS product (PHP-based web platform), not a third-party extension.

RemediationAI

Upgrade to a Joomla! CMS release outside the affected ranges as identified in the vendor advisory at https://developer.joomla.org/security-centre/1044-20260512-core-mfa-authentication-bypass.html (patch available per vendor advisory; the exact fixed version should be taken from that advisory as it is not independently enumerated in the provided data). Until patched, compensating controls include disabling MFA bypass-prone login paths by restricting administrator access to known IP ranges via web server or WAF rules, forcing password resets on privileged accounts to neutralise any pre-compromised first-factor credentials, and monitoring authentication logs for sessions that reach authenticated state without a corresponding MFA-success event - note that IP allow-listing can lock out legitimate remote admins and aggressive monitoring may produce noise on busy sites.