Joomla CMS CVE-2026-90914

Exploitation requires a high-privileged authenticated backend account (CVSS PR:H) to inject an unescaped script payload into content rendered through Joomla's generic audio or video media output layouts, plus victim user interaction (UI:P) - a second user must load the page that renders the affected media output for the script to fire. This is not remotely exploitable by anonymous users: the PR:H authentication requirement and the required victim page-view are the primary limiting factors, confining realistic abuse to rogue or compromised elevated accounts on Joomla 4.0.0-5.4.8 or 6.0.0-6.1.3.

This is a stored/reflected XSS (CWE-79) in Joomla core's generic audio and video output layouts, self-reported by Joomla under advisory 20260904. The vendor CVSS 4.0 vector (5.9) is authenticated-and-interaction-gated: AV:N/AC:L/AT:N/PR:H/UI:P, meaning a high-privileged backend user must inject the payload and a victim must view the media output. The vendor scored impact as VC:H/VI:H (high confidentiality and integrity), which is aggressive for a reflected/stored XSS confined to the browser context - a script-in-page typically yields limited confidentiality/integrity (session/DOM manipulation), so C:H/I:H appears OVERSTATED; a more defensible read is C:L/I:L with a scope change, landing near 5.4. Exploitation signals are uniformly low: EPSS is not provided, the vulnerability is NOT in CISA KEV, and the vendor sets E:U (Unreported/no exploit maturity), so there is no public exploit identified at time of analysis. The dominant limiting factor is PR:H - an attacker already needs elevated backend privileges to plant the payload, which sharply narrows the realistic attacker population to compromised/rogue admin-level accounts. Net: despite Joomla being ubiquitous, this is a real-but-modest-priority issue, not a high-urgency remote unauthenticated flaw. Key data gap: no independent EPSS/POC and vendor CVSS impact metrics warrant scrutiny - verify the actual confidentiality/integrity reach against the vendor advisory.

A high-privileged Joomla backend user (or an attacker who has compromised such an account) inserts a malicious script payload into content that renders through the generic audio/video media output layouts, which fail to escape it. When another user - such as an administrator or site visitor - loads the page containing that media output, the script executes in their browser session. No public exploit code is identified at time of analysis.