Joomla! CMS CVE-2026-48947

The attacker must possess a valid Joomla account with high-privilege role assignment (PR:H per CVSS 4.0) - unauthenticated exploitation is not possible. The targeted Joomla instance must expose com_media webservice endpoints over the network (AV:N), which is the default for Joomla installations that have the API layer enabled. The critical limiting factor is that the attacker's account must lack 'edit media' permissions - the flaw is that this absence is not enforced. Accounts with full editorial rights are not the exploiting actor; rather, accounts in roles that have some privilege but are intentionally denied media editing rights are the at-risk vector. No special platform, non-default configuration toggle, or specific deployment mode beyond API enablement is required.

The CVSS 4.0 score of 6.4 reflects a moderate-to-significant risk profile. The PR:H requirement is the primary mitigating factor - only users already holding a high-privilege Joomla account can exploit this, substantially narrowing the attacker pool to insiders, compromised privileged accounts, or social-engineered administrators. AC:L and UI:N mean that once those prerequisites are met, exploitation is straightforward and requires no special timing or victim interaction. The scope change metrics (SC:H/SI:H/SA:H) are the most alarming signal: overwriting media files could corrupt content delivered to end users, inject malicious payloads into media assets served site-wide, or disrupt availability of dependent services - amplifying the true blast radius well beyond the VI:L direct impact. No EPSS data or KEV listing was provided, and no public exploit has been identified, suggesting this is not yet seeing opportunistic mass exploitation. The realistic threat model is an insider threat or a lateral-movement scenario where an attacker has already compromised a privileged but non-editorial Joomla account.

An attacker who has obtained or controls a privileged Joomla account - such as a manager or custom-role user - without explicit 'edit media' permission directly calls a com_media REST API endpoint with a crafted overwrite request targeting an existing media file. The server performs no permission check on the overwrite action, accepts the payload, and replaces the legitimate media asset. The attacker could substitute a widely-served image with a malicious file or deface site content without detection through normal editorial audit trails. No public exploit code has been identified at time of analysis.