Joomla! CMS CVE-2026-48947

Q: What is the CVSS score of CVE-2026-48947?

CVE-2026-48947 has a CVSS 4.0 base score of 6.4 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-42069 MEDIUM

Improper Access Control (CWE-284)

2026-07-07 Joomla

GHSA-pqwf-qvrr-q52g

Authentication Bypass Joomla Cms Joomla Project

6.4

CVSS 4.0 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

6.4 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.6 HIGH

Network-accessible API, PR:H for required privileged account, scope change due to site-wide media impact; availability impact limited to L as overwrite does not inherently crash services.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 07, 2026 - 19:06 vuln.today

DescriptionCVE.org

An improper access check allows privileged users to overwrite media files without editing permissions.

AnalysisAI

Improper access control in Joomla! CMS's com_media webservice endpoints allows privileged users to overwrite media files even when they lack explicit editing permissions. The flaw affects two active release lines - 4.1.0 through 5.4.6 and 6.0.0 through 6.1.1 - and is confirmed by the Joomla Security Centre. The CVSS 4.0 vector (SC:H/SI:H/SA:H) indicates that while the direct impact on the vulnerable system is limited (VI:L), successful exploitation can cascade into high-impact consequences on the broader site or dependent systems. No public exploit or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

The affected component is com_media, Joomla's media management subsystem exposed via web service (REST API) endpoints. CWE-284 (Improper Access Control) identifies the root cause: the endpoint's authorization logic fails to verify whether the calling user holds editing permissions before permitting a file overwrite operation. The flaw is distinct from a typical authentication bypass - the attacker is authenticated and holds some elevated privilege (PR:H per CVSS 4.0), but the authorization check for the specific 'edit media' capability is absent or incorrectly scoped. The CPE cpe:2.3:a:joomla!_project:joomla!_cms:*:*:*:*:*:*:*:* confirms the vulnerability exists in the upstream Joomla! CMS project across both the 4.x/5.x and 6.x release lines.

RemediationAI

Patch available per vendor advisory - consult the Joomla Security Centre at https://developer.joomla.org/security-centre/1055-20260701-core-incorrect-access-control-in-com-media-webservice-endpoints.html for the exact patched release targeting both the 4.x/5.x and 6.x lines. The provided input data does not confirm specific fixed version numbers, so administrators should verify the minimum safe version from the advisory before upgrading. As an interim compensating control, restrict access to com_media webservice endpoints at the web server or WAF layer for any user roles that should not have media editing rights - be aware this will break legitimate API clients using those endpoints. Additionally, audit Joomla user accounts with high-privilege roles to identify any with unexpectedly broad API access, and consider enforcing the principle of least privilege across role assignments. Disabling the webservice layer entirely (if not required) eliminates the attack surface with no side effects beyond API consumers.