Joomla! CMS CVE-2026-48956

Q: What is the CVSS score of CVE-2026-48956?

CVE-2026-48956 has a CVSS 4.0 base score of 6.4 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-42065 MEDIUM

Improper Access Control (CWE-284)

2026-07-07 Joomla

GHSA-x853-rpgv-6qxj

Authentication Bypass Joomla Cms Joomla Project

6.4

CVSS 4.0 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

6.4 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Network-accessible frontend endpoint, low complexity; PR:L assumed as 'users' implies authenticated but low-privilege access; impact limited to module list disclosure only.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 07, 2026 - 18:55 vuln.today

DescriptionCVE.org

An improper access check allows users to display a list of modules in the frontend.

AnalysisAI

Incorrect access control in Joomla! CMS's com_modules component exposes the module listing interface to frontend users who should not have visibility into installed modules. The flaw stems from CWE-284 (Improper Access Control), where the frontend fails to enforce sufficient privilege checks before returning module enumeration data. No public exploit or CISA KEV listing has been identified at time of analysis, and the EPSS score is not provided in source data, but the CVSS 4.0 score of 6.4 reflects meaningful subsequent-system impact potential stemming from reconnaissance value of the disclosed module inventory.

Technical ContextAI

Joomla! CMS is a PHP-based content management system. The affected component is com_modules, the core extension that manages and renders Joomla modules (sidebar widgets, banners, navigation blocks, custom HTML, etc.). The CWE-284 (Improper Access Control) root cause indicates the frontend controller or view layer omits or incorrectly evaluates the ACL (Access Control List) check that should restrict module listing to privileged users only. Joomla's ACL system is layered - backend vs. frontend access is governed by group permissions and component-level authorization checks. A missing or bypassed isAuthorised() call in the com_modules frontend dispatcher would expose module metadata to callers who lack the required privilege level. The CPE string (cpe:2.3:a:joomla!_project:joomla!_cms:*:*:*:*:*:*:*:*) uses wildcards, meaning the specific affected version range is not defined in CPE data and must be determined from the Joomla Security Centre advisory.

RemediationAI

Apply the patch released by the Joomla! Project as detailed in the official security advisory at https://developer.joomla.org/security-centre/1064-20260710-core-incorrect-access-control-in-com-modules.html. The advisory should specify the fixed version; no exact fix version number is independently confirmed from the available input data. As a compensating control pending patching, administrators can restrict frontend access to the com_modules component by modifying Joomla's ACL settings to explicitly deny module-related views to unintended user groups - this should be done through the backend under Users > Access Levels, with the trade-off that overly broad restrictions could break legitimate module rendering. Additionally, Web Application Firewall rules can be configured to block or alert on requests targeting the com_modules frontend endpoint from unauthenticated or low-privilege sessions. Monitor Joomla update channels via the Joomla Security Strike Team RSS feed for patch availability confirmation.