Which versions of Joomla! CMS are affected by CVE-2026-48898?

Joomla! CMS versions 4.0.0-5.4.5 and 6.0.0-6.1.0 contain a privilege escalation vulnerability (CVE-2026-48898) allowing attackers to modify user accounts and escalate privileges through an improper…

How to fix or mitigate CVE-2026-48898?

Within 24 hours: Complete inventory of Joomla installations and identify systems running versions 4.0.0-5.4.5 or 6.0.0-6.1.0; assess scope of exposure. Within 7 days: Restrict administrative backend access to trusted IP ranges via network segmentation; disable batch operations in the com_users component; enable comprehensive audit logging for user account modifications. Within 30 days: Monitor Joomla security advisories weekly for patch releases (anticipated versions 5.4.6+ and 6.1.1+); develop change management plan for patch deployment; evaluate migration strategy to patched versions once released.

Joomla! CMS CVE-2026-48898

Q: What is the CVSS score of CVE-2026-48898?

CVE-2026-48898 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31873 HIGH

Improper Access Control (CWE-284)

2026-05-26 Joomla

GHSA-8p98-hxh2-cfpv

Authentication Bypass Privilege Escalation Joomla Cms Joomla Project

8.2

CVSS 4.0 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

8.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (Joomla) · only source for this CVE.

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 08:59 vuln.today

CVSS changed

May 26, 2026 - 17:22 NVD

8.2 (HIGH)

CVE Published

May 26, 2026 - 16:42 nvd

UNKNOWN (no severity yet)

CVE Published

May 26, 2026 - 16:42 nvd

HIGH 8.2

DescriptionCVE.org

An improper access check allows privilege escalation through the com_users batch task.

AnalysisAI

Privilege escalation in Joomla! CMS versions 4.0.0-5.4.5 and 6.0.0-6.1.0 allows remote attackers to abuse the com_users batch task due to an improper access check (CWE-284). The flaw enables unauthorized modification of user accounts and elevation of privileges across affected installations, with no public exploit identified at time of analysis. EPSS scoring is 0.00% and the vulnerability is not listed in CISA KEV, but the CVSSv4 base score of 8.2 reflects high integrity impact.

Technical ContextAI

Joomla! is a widely deployed PHP-based content management system, and com_users is its core component responsible for managing user accounts, groups, and ACL assignments. The batch task within com_users is intended for administrators to apply bulk operations (such as group reassignment or state changes) across multiple user records. CWE-284 (Improper Access Control) indicates the batch task endpoint does not adequately verify whether the requesting user holds the privileges needed to perform the targeted change, permitting cross-tier modification of user records and effective privilege elevation. The CVSS vector (AV:N/AC:L/AT:P/PR:N/UI:N) further indicates this is reachable over the network with low complexity, though the AT:P (Attack Requirements: Present) flag implies some deployment-specific precondition must be met for the batch task path to be reachable.

RemediationAI

Patch available per vendor advisory - upgrade Joomla! CMS to a version newer than 5.4.5 in the 5.x branch or newer than 6.1.0 in the 6.x branch as specified at https://developer.joomla.org/security-centre/1045-20260513-core-privilege-escalation-through-com-users-batch-task.html; exact fixed version numbers were not independently confirmed in the available data and should be taken from that advisory. Until the upgrade is applied, restrict access to the /administrator/ backend via IP allow-listing or VPN to limit reachability of com_users endpoints (trade-off: blocks legitimate remote admin sessions), audit user group memberships and recent batch operations in the audit log for unexpected privilege grants, and consider temporarily disabling or restricting use of the User Manager batch operation through ACL review. Avoid relying solely on WAF rules, as the batch task uses standard component routing that is difficult to distinguish from legitimate admin traffic.