Joomla! CMS CVE-2026-48899

Exploitation requires the attacker to hold at minimum a low-privileged authenticated Joomla account (confirmed by CVSS PR:L). The specific trigger is the com_users component's batch task functionality being reachable under the attacker's session - a condition likely present in default configurations where user self-registration is enabled. Exploitation is hard-limited by the authentication requirement; unauthenticated anonymous attackers cannot exploit this flaw. SSVC rates the vulnerability as not automatable, meaning scripted mass exploitation targeting large numbers of sites simultaneously is assessed as infeasible with current information. No additional non-default configuration, specific platform version, or special feature flag is described as required beyond authenticated access to the com_users batch endpoint. Defenders should treat any Joomla site with open user registration as exposed until patched.

The CVSS 4.0 base score of 5.3 (Medium) with vector AV:N/AC:L/AT:N/PR:L/UI:N reflects remote, low-complexity exploitation requiring low-level authentication. Despite the medium CVSS score, SSVC rates the technical impact as total, signaling that successful exploitation can lead to full privilege escalation within the application - a notable upward divergence from the numeric score alone. EPSS at 0.00% (0th percentile) and SSVC exploitation status of none indicate no observed in-the-wild exploitation and no confirmed public exploit code, consistent with absence from the CISA KEV catalog. SSVC also rates the flaw as not automatable, meaning mass exploitation across many installations simultaneously is not currently feasible. The combination of network accessibility, zero-complexity trigger, and total technical impact makes this a meaningful priority for any Joomla deployment that permits user self-registration or hosts untrusted authenticated users - even absent observed exploitation, the low bar to attempt exploitation warrants prompt patching.

An attacker registers or already holds a low-privileged Joomla account (e.g., a Registered or Author role) and submits a crafted HTTP POST request directly to the com_users batch task controller, manipulating parameters to trigger a privileged operation such as assigning their own account to the Administrator group. The improper access check fails to validate the caller's actual privilege level against the requested operation, and the elevation succeeds silently. No public exploit code has been identified, but the low complexity and network accessibility of the attack vector mean this requires only basic web interaction from any authenticated user.