Joomla! CMS CVE-2026-48958

Q: What is the CVSS score of CVE-2026-48958?

CVE-2026-48958 has a CVSS 4.0 base score of 6.4 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-42068 MEDIUM

Improper Access Control (CWE-284)

2026-07-07 Joomla

GHSA-c3p9-2r8w-w7xv

Authentication Bypass Joomla Cms Joomla Project

6.4

CVSS 4.0 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

6.4 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.0 MEDIUM

Network REST endpoint, low complexity; PR:L reflects authenticated-but-lower-than-required access per Authentication Bypass tag; scope change acknowledged but direct confidentiality impact is absent.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 07, 2026 - 18:52 vuln.today

DescriptionCVE.org

An improper access check allows unauthorized users to create custom fields via webservices endpoints.

AnalysisAI

Incorrect access control in Joomla! CMS exposes com_fields REST API webservices endpoints to users who lack the required permissions, allowing them to create custom field definitions that should be restricted to higher-privileged roles such as Manager or Administrator. The flaw originates from a missing or incorrectly evaluated ACL check in the webservices layer and is confirmed by Joomla's own Security Centre in advisory 20260712. No public exploit has been identified at time of analysis, though the CVSS scope-change metrics indicate potential for significant downstream impact to site content and dependent integrations if unauthorized field definitions are used to inject malicious markup.

Technical ContextAI

The affected component is Joomla!'s com_fields (Custom Fields) subsystem, exposed through the Joomla REST API introduced in Joomla 4.0 via the plg_webservices_fields plugin. Custom fields extend Joomla content types with administrator-defined metadata, and the webservices layer provides CRUD endpoints at /api/index.php/v1/fields to manage them programmatically. CWE-284 (Improper Access Control) identifies the root cause class: the endpoint either omits the ACL check, evaluates it against the wrong permission node, or allows the check to be bypassed through a crafted request. The CPE string cpe:2.3:a:joomla!_project:joomla!_cms:*:*:*:*:*:*:*:* covers all Joomla! CMS versions, but the webservices attack surface is specific to Joomla 4.x and later where the REST API framework exists.

RemediationAI

Upgrade to the patched Joomla! CMS version specified in the Joomla Security Centre advisory at https://developer.joomla.org/security-centre/1066-20260712-core-incorrect-access-control-in-com-fields-webservice-endpoints.html; the exact fixed version number is not independently confirmed from available data and must be retrieved from the advisory directly. As an immediate compensating control for sites unable to patch, disable the webservices fields plugin via System > Plugins > 'Fields - Web Services' to remove the vulnerable endpoint entirely - note this will break any REST API clients consuming or managing custom fields data. Alternatively, restrict network access to the Joomla /api/ URL path at the web server (via location block deny rules) or perimeter firewall to limit endpoint exposure to known trusted clients only; this reduces attack surface without breaking the API for authorized integrations.