Joomla! CMS CVE-2026-48951

Exploitation requires the attacker to hold a high-privilege Joomla! CMS account (PR:H per CVSS 4.0 vector), such as a Super Administrator or another role with access to the affected backend components. Additionally, a second authenticated user (likely another administrator) must passively interact with or load the compromised modalreturn layout (UI:P per CVSS 4.0 vector) for the XSS payload to execute against them. The vulnerability is confined to the administrative backend interface, specifically the modalreturn layout pattern used across multiple core components - it is not exploitable through the public-facing frontend by unauthenticated visitors. Limiting factors: requires existing high-privilege credentials, requires victim interaction with the modal, and is restricted to admin-area components only.

The CVSS 4.0 score of 5.9 reflects a meaningful but bounded risk. Key limiting factors are PR:H (high privileges required to inject the payload) and UI:P (passive user interaction required for the XSS to execute against a victim). This significantly narrows the attack surface compared to an unauthenticated XSS - exploitation requires an attacker who already holds a high-privilege Joomla! account, such as a super administrator or privileged editor, making this most relevant to insider-threat, compromised-credential, or multi-tenant hosting scenarios. The VC:H and VI:H impact metrics reflect that a successful XSS in the admin backend could allow full session hijacking or administrative action on behalf of the victim. E:U in the vector indicates no known public exploit. No EPSS score was provided in available intelligence. No KEV listing confirms there is no confirmed active exploitation. The combination of high required privileges and passive user interaction means this is a genuine but non-critical priority for most organizations - teams running shared Joomla! hosting or multi-editor environments should treat it more seriously.

An attacker who has obtained or controls a high-privilege Joomla! account (e.g., through credential phishing or a compromised shared admin account) injects an unescaped JavaScript payload into a field processed by a modalreturn layout. When a second authenticated administrator opens or interacts with the affected modal component, the payload executes in their browser context, enabling session token theft or silent execution of administrative actions such as creating a backdoor admin account. No public proof-of-concept code is identified at time of analysis, but the vulnerability class is well-understood and the attack is straightforward to construct from the description.