Joomla! CMS CVE-2026-48955

The attacker must hold a valid authenticated Joomla! account of any role - fully unauthenticated exploitation is inconsistent with the PR:H CVSS 4.0 metric, though the exact minimum privilege level is not independently confirmed and may be lower than PR:H implies given the 'unauthorized users' language in the description. The Joomla! Workflow feature (com_workflow) must be enabled and actively configured on the target instance; this is not a default-active feature on all deployments and is most common on editorial or multi-author publishing sites. Exploitation is limited to reading workflow stage names and transition configurations - direct data modification, remote code execution, and unauthenticated access are not indicated by any available data. Sites that do not use the Joomla workflow feature are not exposed to meaningful risk even without patching.

The CVSS 4.0 score of 6.4 places this in the medium band. The provided vector's PR:H assignment is in tension with the description's reference to 'unauthorized users' and the 'Authentication Bypass' tag; the most consistent interpretation is that a legitimately authenticated Joomla user lacking workflow manager permissions can still reach the restricted endpoint, making this an authorization bypass rather than a full authentication bypass. The SC:H/SI:H/SA:H subsequent-system impacts appear elevated relative to a read-only workflow metadata disclosure - no integrity or availability mechanism is described, and these ratings likely reflect vendor threat modeling of chained attack scenarios not detailed in the public advisory. No EPSS data is available, no KEV listing exists, and no POC has been identified, all pointing to low immediate exploitation pressure. Real-world priority is medium for organizations actively using Joomla's workflow feature; sites not using com_workflow are not meaningfully exposed.

An attacker with a valid but low-privilege Joomla account - such as a Registered or Author role - sends a crafted HTTP request directly to the com_workflow component endpoint, bypassing the access control gate due to the improper authorization check. The server returns workflow stage names, ordering, and configured transition rules that the user's role should not be permitted to view. The attacker uses this to map the site's content approval chain, identifying reviewer identities or timing patterns to inform a subsequent targeted attack against content publication integrity. No public exploit code has been identified at time of analysis.