Joomla! CMS CVE-2026-48955

Q: What is the CVSS score of CVE-2026-48955?

CVE-2026-48955 has a CVSS 4.0 base score of 6.4 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-42066 MEDIUM

Improper Access Control (CWE-284)

2026-07-07 Joomla

GHSA-9hj5-278h-wg3j

Authentication Bypass Joomla Cms Joomla Project

6.4

CVSS 4.0 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

6.4 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Network-accessible authorization bypass requiring authenticated but low-privilege access; impact confined to read-only workflow metadata disclosure with no integrity or availability consequence.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 07, 2026 - 18:57 vuln.today

DescriptionCVE.org

An improper access check allows unauthorized users to access workflow stage and transition information.

AnalysisAI

Unauthorized access to workflow stage and transition data in Joomla! CMS is possible due to an improper access check in the com_workflow component (CWE-284), allowing authenticated users who lack the necessary workflow management permissions to read internal content publication configuration. The CVSS 4.0 vector assigns high subsequent-system impacts (SC:H/SI:H/SA:H), suggesting the vendor assessed this metadata exposure as a meaningful enabler of broader content pipeline compromise. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

The vulnerability resides in Joomla!'s built-in com_workflow component, which manages content publication stages and configured transitions introduced in Joomla 4.x. CWE-284 (Improper Access Control) identifies the root cause as a missing or insufficient server-side authorization check on the endpoint returning workflow stage and transition data. The CPE string cpe:2.3:a:joomla!_project:joomla!_cms:*:*:*:*:*:*:*:* uses a wildcard version range, indicating the precise affected version band has not been narrowed in the available data. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H) marks the attack as network-accessible with low complexity and no special attack requirements, while the PR:H metric indicates some elevated authentication context is required - a notable tension with the 'Authentication Bypass' tag, which likely refers to an authorization bypass rather than a complete pre-authentication exploit.

RemediationAI

Consult the Joomla! Security Centre advisory at https://developer.joomla.org/security-centre/1063-20260709-core-incorrect-access-control-in-com-workflow.html for the specific patched release; an exact fix version is not independently confirmed from available data, but the advisory is dated 2026-07-09 and should be treated as authoritative. As a compensating control, administrators should restrict com_workflow permissions to trusted administrative roles only via Joomla's Global Configuration > Permissions interface - specifically, ensure only 'Super Users' or designated 'Workflow Managers' hold access to workflow stage and transition management. For sites that do not require staged content publication, disabling the Workflow feature entirely eliminates the attack surface with no impact on sites using standard Joomla article publishing; note that disabling workflow will remove the content staging and approval queue functionality.