Joomla! CMS CVE-2026-48904

Exploitation requires that the target Joomla site has the Web Services API enabled and the com_users webservice (group editing endpoint) reachable to the attacker - this is the AT:P precondition reflected in the CVSS vector. The CVSS vector indicates PR:N (no privileges) and UI:N (no user interaction), so no valid Joomla account or victim click is required once the endpoint is reachable. Exploitation is limited to Joomla! CMS 4.0.0-5.4.5 and 6.0.0-6.1.0; sites on earlier 3.x branches, on fixed releases above these ranges, or with the Users webservice plugin disabled / the /api/ tree firewalled off are not exploitable via this path.

Signals point in conflicting directions and should be weighed carefully. CVSS 4.0 is 8.2 (High) with AV:N/AC:L/AT:P/PR:N/UI:N and VI:H - network vector, low complexity, no privileges, no user interaction, high integrity impact - which on paper is a serious unauthenticated privilege escalation against a widely deployed CMS. However, EPSS is 0.00% (0th percentile), SSVC reports Exploitation: none and Automatable: no (though Technical Impact: total), and the vulnerability is not on CISA KEV. The AT:P (Attack Requirements: Present) sub-vector in CVSS 4.0 indicates some deployment-specific precondition beyond a default install, which partially explains the low automatable/EPSS signals. Net assessment: this is a real priority for Joomla operators given the total technical impact and unauthenticated network reach, but absence of observed exploitation and the AT:P requirement suggest it is not yet a mass-exploitation event. Note also that PR:N in the vector conflicts somewhat with the description's framing of 'privilege escalation' (which usually implies an existing account) - defenders should verify with the Joomla advisory whether the endpoint is reachable pre-auth or requires a low-privileged session.

A remote attacker reaches the Joomla site's /api/ webservice endpoint for com_users group editing and issues a crafted request to modify a group's permissions or add a controlled account to a privileged group such as Super Users, bypassing the missing access check. With the elevated account, the attacker logs into the Joomla administrator backend and installs a malicious extension to achieve full site takeover. No public POC has been identified at time of analysis, but the attack complexity is low once the precondition (AT:P) in the deployment is satisfied.