Joomla! CMS CVE-2026-48958

The Joomla REST API must be active, which requires the plg_webservices_fields plugin to be enabled - this is not the default state on all Joomla installations and requires deliberate activation. The attacker must hold valid Joomla credentials; 'unauthorized users' in the description refers to users lacking the specific ACL permission to manage custom fields, not fully unauthenticated actors. The exact minimum authentication level required is inconsistent between the vendor-provided CVSS PR:H metric and the 'Authentication Bypass' tag - PR:H would limit exploitation to already-privileged accounts, while the tag implies lower-privilege bypass; this ambiguity must be resolved via the full advisory. Exploitation is further bounded by network reachability to the /api/ endpoint path.

The vendor-assigned CVSS 4.0 score of 6.4 reflects a medium base severity, but the subsequent-system impact triad of SC:H/SI:H/SA:H in the provided vector indicates that malicious custom field definitions, once created, could propagate significant harm to rendered site content and downstream integrations. A notable inconsistency exists between the PR:H metric in the provided CVSS 4.0 vector and the description's reference to 'unauthorized users' combined with the 'Authentication Bypass' tag - PR:H implies high-privilege authentication is still required, while the tag and description language suggest lower-privilege authenticated users are the threat actor; this should be verified against the full advisory text. No EPSS data was supplied and there is no CISA KEV listing, indicating no observed mass exploitation. Real-world risk is bounded by: the REST API plugin must be explicitly enabled, valid Joomla credentials are required, and the /api/ path must be reachable. Overall this is a genuine but moderate-priority finding - impactful in scope but constrained by deployment prerequisites.

An authenticated Joomla user holding a role below Manager or Administrator sends a crafted POST request to /api/index.php/v1/fields, bypassing the missing or flawed ACL check in the com_fields webservices handler. The attacker creates custom field definitions containing malicious markup or template injection payloads that are subsequently rendered across site content, affecting page integrity for all visitors and potentially targeting administrator sessions.