Which versions of Joomla! CMS are affected by CVE-2026-48904?

Joomla! CMS versions 4.0.0 through 6.1.0 contain an unauthenticated privilege escalation vulnerability in the user group management webservice that allows remote attackers to gain administrative…

How to fix or mitigate CVE-2026-48904?

Within 24 hours: Conduct inventory of all Joomla! CMS instances and identify those running versions 4.0.0-5.4.5 or 6.0.0-6.1.0; prioritize internet-facing systems. Within 7 days: Implement network-level access restrictions to the com_users webservice endpoint using firewall rules or WAF policies; if operationally feasible, disable the group editing webservice endpoint entirely. Within 30 days: Monitor Joomla! vendor security advisories and CISA alerts for patch availability; establish testing and deployment procedures to upgrade affected systems to patched versions immediately upon release.

Joomla! CMS CVE-2026-48904

Q: What is the CVSS score of CVE-2026-48904?

CVE-2026-48904 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31875 HIGH

Improper Access Control (CWE-284)

2026-05-26 Joomla

GHSA-x9j9-9cc9-85fc

Authentication Bypass Joomla Cms

8.2

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 10:06 vuln.today

CVSS changed

May 26, 2026 - 17:22 NVD

8.2 (HIGH)

CVE Published

May 26, 2026 - 16:43 nvd

HIGH 8.2

DescriptionCVE.org

An improper access check allows privelege escalation through the com_users group editing webservice endpoint.

AnalysisAI

Privilege escalation in Joomla! CMS versions 4.0.0 through 5.4.5 and 6.0.0 through 6.1.0 allows remote attackers to abuse an improper access check in the com_users group editing webservice endpoint to elevate privileges. The CVSS 4.0 vector indicates network-reachable exploitation without authentication or user interaction, with high impact to integrity but no confidentiality or availability impact. There is no public exploit identified at time of analysis and EPSS is effectively 0%, but the vendor advisory confirms the access-control flaw.

Technical ContextAI

Joomla! CMS exposes a REST webservice API under com_users that handles user group management. The vulnerability is rooted in CWE-284 (Improper Access Control): the group editing endpoint fails to correctly verify that the caller is authorized to modify user group memberships or group definitions, which are the primary mechanism for assigning privileges (including Super User) in Joomla's ACL model. Because Joomla webservices are reachable over HTTP and the access check is the security boundary that gates privilege assignment, a missing or broken check on this specific endpoint directly translates into an ability to alter authorization data. The affected CPE is cpe:2.3:a:joomla!_project:joomla!_cms across the version ranges named in the EUVD advisory.

RemediationAI

Patch available per vendor advisory: upgrade to a fixed Joomla! release in the 5.x or 6.x branch as published in the Joomla Security Centre advisory at https://developer.joomla.org/security-centre/1046-20260514-core-privilege-escalation-through-com-users-webservice-endpoints.html (exact fix version should be taken from that advisory, as the EUVD data only lists the vulnerable ranges 4.0.0-5.4.5 and 6.0.0-6.1.0). If patching cannot be performed immediately, the most targeted compensating control is to disable or restrict the com_users webservice endpoint - either by turning off the Web Services - Users plugin in the Joomla extensions manager, or by blocking access to the /api/index.php/v1/users/groups paths at the reverse proxy or WAF; the trade-off is that any legitimate API-based user/group administration will break. Additionally, restrict access to the /api/ tree to known administrative IP ranges where feasible, and audit Joomla group memberships and Super User accounts for unexpected changes since exposure began.