What is the CVSS score of EUVD-2026-31878?

EUVD-2026-31878 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Joomla! CMS are affected by EUVD-2026-31878?

Joomla! CMS versions 3.9.0-5.4.5 and 6.0.0-6.1.0 contain a critical transport encryption vulnerability in password reset workflows that transmits reset tokens over HTTP instead of HTTPS when SSL…

How to fix or mitigate EUVD-2026-31878?

Within 24 hours: Inventory all Joomla! installations and identify affected versions (3.9.0-5.4.5, 6.0.0-6.1.0). Within 7 days: Enable the 'Force SSL' configuration flag in Joomla! administrator settings on all instances and verify that password/username reset links generate with HTTPS URLs. Within 30 days: Monitor Joomla! security advisories for patch availability and evaluate upgrade timeline to post-6.1.0 releases once patch is released.

Joomla! CMS EUVD-2026-31878

| CVE-2026-48902 CRITICAL

Cleartext Transmission of Sensitive Information (CWE-319)

2026-05-26 Joomla

GHSA-w4ph-7vgc-vxrf

Information Disclosure Joomla Cms

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 28, 2026 - 16:30 vuln.today

CVSS changed

May 28, 2026 - 14:22 NVD

9.8 (CRITICAL)

CVE Published

May 26, 2026 - 16:43 nvd

UNKNOWN (no severity yet)

CVE Published

May 26, 2026 - 16:43 nvd

CRITICAL 9.8

DescriptionCVE.org

The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set.

AnalysisAI

Transport encryption downgrade in Joomla! CMS password and username reset workflows causes reset links to be generated with plain HTTP URLs instead of HTTPS when the 'Force SSL' configuration flag is not explicitly enabled. Affected installations span Joomla! 3.9.0 through 5.4.5 and 6.0.0 through 6.1.0, exposing reset tokens to network interception. No public exploit identified at time of analysis, and EPSS scores exploitation probability at 0.02% (5th percentile) despite the 9.8 CVSS rating.

Technical ContextAI

Joomla! is a widely deployed PHP-based content management system that includes self-service account recovery flows for password and username reset. The reset workflow emails users a tokenized link that, when visited, allows them to complete the recovery action. According to the Joomla! developer advisory, the link-construction logic uses the configured site URL scheme rather than forcing HTTPS, so when an administrator has not enabled the 'Force SSL' option in global configuration the framework emits http:// URLs even on sites that serve traffic over TLS. This is a transport encryption downgrade pattern (aligned with CWE-319 Cleartext Transmission of Sensitive Information, though no CWE was assigned in the input) where a sensitive bearer token is delivered to the user agent in clear-text-capable form. The CPE explicitly identifies cpe:2.3:a:joomla!_project:joomla!_cms as the affected product family.

RemediationAI

Patch available per vendor advisory: upgrade to a fixed Joomla! release above 5.4.5 on the 3.x-5.x line and above 6.1.0 on the 6.x line as published in the Joomla! Security Centre bulletin at https://developer.joomla.org/security-centre/1050-20260518-core-transport-encryption-downgrade-for-password-and-username-reset-links.html (exact patched build numbers should be taken from that advisory, as the input data does not enumerate them). As an immediate compensating control administrators should enable the 'Force SSL = Entire Site' option in Global Configuration, which causes Joomla! to always emit https:// URLs (including in reset emails) - the trade-off is that any legacy embedded resource still referenced over http will need to be migrated to avoid mixed-content breakage. Additionally, enforce HSTS at the web server or CDN layer so that even if an http link is generated the user agent upgrades the request before it leaves the browser, accepting that HSTS only protects users who have previously visited the site over HTTPS.