Joomla! CMS CVE-2026-48898

The com_users batch task code path must be reachable, which in standard Joomla deployments means the attacker needs network access to the site's administrator endpoint or to the front-end request handler that proxies into the User Manager batch operation. The CVSSv4 AT:P (Attack Requirements: Present) flag combined with the description's reference to a specific component (com_users batch task) indicates the flaw is not triggerable against arbitrary URLs - it requires submitting a properly formed batch task request to the User Manager component. PR:N in the vector suggests no authentication token is strictly required for the vulnerable check to fail, but practical exploitation is limited to deployments running Joomla! CMS 4.0.0-5.4.5 or 6.0.0-6.1.0 with com_users enabled (the default). No user interaction is required (UI:N).

Signals are mixed: the CVSSv4 base score of 8.2 (High) reflects total integrity loss (VI:H) achievable over the network without privileges or user interaction, while EPSS is 0.00% and SSVC reports Exploitation: none, Automatable: no, Technical Impact: total. The combination suggests a high-impact but not-yet-exploited issue - consistent with a vendor-disclosed flaw that lacks public PoC. Note a conflict worth flagging: the CVSS vector lists PR:N (no privileges) and the tag set includes 'Authentication Bypass', yet com_users batch tasks are traditionally administrator-side functionality - the AT:P flag (Attack Requirements: Present) implies a non-default precondition or partial access is needed, so the practical exploitability is likely more constrained than PR:N alone suggests. With no KEV listing and no public exploit identified at time of analysis, this is a priority patch for internet-facing Joomla deployments but not an emergency over already-mitigated environments.

A remote attacker reaches the Joomla front-end or administrator interface and crafts a request to the com_users batch task endpoint that targets accounts the attacker should not be able to modify, leveraging the missing access check to reassign target accounts (including their own session-linked account) into a higher-privileged user group such as Super Users. The result is elevation to administrative control of the CMS, enabling content tampering, extension installation, and full site compromise. No public exploit identified at time of analysis, but the simplicity of the batch task surface makes weaponization plausible once patch diffs are reviewed.