Joomla! CMS CVE-2026-48948

Q: What is the CVSS score of CVE-2026-48948?

CVE-2026-48948 has a CVSS 4.0 base score of 6.4 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-42061 MEDIUM

Improper Access Control (CWE-284)

2026-07-07 Joomla

GHSA-qm46-px7w-x2xj

Authentication Bypass Joomla Cms Joomla Project

6.4

CVSS 4.0 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

6.4 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Network-exploitable, low complexity, but PR:L since authentication is required; impact is confidentiality-only (contact data), scope unchanged.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 07, 2026 - 19:05 vuln.today

DescriptionCVE.org

An improper access check allows user to download vcard exports of com_contact contacts that are inaccessible.

AnalysisAI

Improper access control in Joomla! CMS com_contact component exposes restricted contact records via vcard (VCF) export to authenticated users who should not have access. Affecting versions 3.0.0 through 5.4.6 and 6.0.0 through 6.1.1, the flaw allows an authenticated user to bypass access restrictions and download vcard exports of contacts that have been explicitly restricted from their view. No public exploit code or active exploitation has been identified at time of analysis, but the wide deployment footprint of Joomla and the breadth of affected versions (spanning both the 3.x/5.x and 6.x branches) make patching a priority for sites using the com_contact component.

Technical ContextAI

The vulnerability resides in Joomla!'s com_contact component, the built-in contacts extension for the CMS (CPE: cpe:2.3:a:joomla!_project:joomla!_cms). The component supports VCF (vCard Format) exports that allow visitors or users to download contact information as a standardized file. CWE-284 (Improper Access Control) indicates the root cause is a missing or insufficient authorization check in the code path that handles VCF download requests - the system does not correctly verify that the requesting user has permission to view the specific contact record before serving the export. This class of flaw is distinct from authentication bypass: the user is authenticated but the per-contact access control gate is simply not enforced during the download action, allowing a user to supply an arbitrary contact ID and retrieve data they are not permitted to see.

RemediationAI

Patch available per vendor advisory - administrators should consult the Joomla Security Centre advisory at https://developer.joomla.org/security-centre/1056-20260702-core-incorrect-access-control-in-com-contact-vcf-download.html to identify the fixed release version for their branch (5.x or 6.x) and upgrade immediately. No exact fixed version numbers are confirmed in the available intelligence data, so the advisory should be consulted directly for authoritative patch version information. As a compensating control for sites that cannot patch immediately, administrators can disable the VCF download feature within com_contact configuration, or temporarily unpublish the com_contact component entirely if contact functionality is non-critical - note that either action disables contact exports for all users. Restricting front-end access to the Joomla site to trusted authenticated users via IP allowlist is a further layer of defense, though this is not always operationally feasible.