Joomla! CMS CVE-2026-48900

The attacker must have an active, authenticated session to the Joomla! CMS backend - unauthenticated or front-end-only users cannot reach the com_scheduler component. At least one scheduler task must already exist in the system for the attacker to target; the vulnerability is an edit-time access-control bypass on existing tasks, not task creation. The CVSS vector (PR:H) suggests the required privilege level may be higher than a basic registered front-end user - likely a backend-credentialed account - though the description's reference to 'low privileged users' implies the threshold is below full administrator. The vulnerability does not require any special non-default configuration of the scheduler component; any Joomla! site running an affected version with backend user accounts and at least one scheduled task is potentially exposed. Exploitation is limited by the authentication requirement and the SSVC finding that it is not automatable.

The CVSS 4.0 base score of 6.4 reflects a network-reachable, low-complexity attack (AV:N/AC:L/AT:N) requiring no user interaction (UI:N), but the PR:H designation (high privileges required) introduces a tension with the plain-language description stating 'low privileged users' are the threat actors. This discrepancy should be verified against the vendor advisory - it may reflect Joomla's internal privilege taxonomy where any backend-credentialed user is considered 'high privilege' in CVSS terms, or the vector may have been miscalibrated. EPSS is 0.00% at the 0th percentile, and the SSVC assessment confirms exploitation status as 'none' and automatable as 'no', both signaling negligible opportunistic exploitation risk at this time. Despite the elevated downstream impact (SI:H/SA:H), the combination of required authentication, absence of public exploit code, no KEV listing, and low EPSS places this firmly in a 'monitor and patch' posture rather than an emergency-response priority. The partial SSVC technical impact rating further tempers urgency.

An authenticated Joomla backend user with low-level permissions - such as a contributor or editor account - crafts an HTTP request to the com_scheduler endpoint that modifies the task type of an existing scheduler job to one with elevated operational impact, such as a file-system or database maintenance task. Because the access check is improperly implemented, the request is processed without verifying the user's ACL entitlement for task-type modification, allowing the attacker to repurpose a scheduled job. The altered task then executes under the scheduler's context on its next run, potentially causing data manipulation or service disruption on connected systems.