Joomla! CMS CVE-2026-48956

Exploitation requires network access to a Joomla! CMS installation's frontend and a user session at a privilege level below what should normally be authorized to view module listings - the precise minimum privilege tier (unauthenticated vs. registered user) is not fully determinable from the description alone and conflicts with the CVSS 4.0 PR:H rating. The CVSS 4.0 vector's PR:H would imply a high-privilege actor (e.g., Joomla Manager or Administrator group) is required, but this conflicts with the 'Authentication Bypass' tag and the framing of the description ('allows users'). No special configuration is required based on AC:L/AT:N - the flaw is present in default Joomla deployments using the com_modules component. Exploitation is limited to information disclosure of the module inventory; direct code execution or data modification are not indicated by available data. The vulnerability is constrained to installations reachable over the network on the frontend.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H) presents a notable internal tension: PR:H indicates exploitation requires high privileges, yet the subsequent-system impacts are all rated High (SC:H/SI:H/SA:H), implying a high-privilege actor can leverage disclosed module information to cause significant damage to downstream or chained systems. The VC:L on the vulnerable system itself aligns with the description (low-sensitivity module list), but the SC:H/SI:H/SA:H rating warrants scrutiny - Joomla's security team may be accounting for the reconnaissance value of module enumeration enabling targeted follow-on attacks against specific installed extensions with known vulnerabilities. This is plausible but not independently confirmable from the description alone. No POC, no KEV listing, and no EPSS score are available. Real-world priority should be moderate: the core impact is information disclosure (module inventory), but in environments running vulnerable or sensitive modules, that disclosure could serve as a meaningful stepping stone. Defenders should weigh patch effort against the actual sensitivity of their module configuration.

An authenticated user (or an attacker who has obtained a low-privilege Joomla frontend account) sends a crafted HTTP GET request to the com_modules frontend endpoint. Due to the missing or insufficient ACL check, the server returns the full module listing - including module type names, positions, ordering, and potentially publishing state - that should only be accessible to backend administrators. The attacker uses this inventory to identify installed extensions with known CVEs and pivot to targeted exploitation. No public exploit code has been identified at time of analysis.