What is the CVSS score of EUVD-2026-39438?

EUVD-2026-39438 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

K2 Extension EUVD-2026-39438

| CVE-2026-48943 MEDIUM

Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915)

2026-06-25 Joomla

GHSA-x6c6-vg4w-8r3r

Information Disclosure K2 Extension For Joomla Getk2 Com

6.5

CVSS 3.1 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Requires a registered Joomla account (PR:L, not PR:N); network-based HTTP POST with no complexity; limited integrity write to own row and partial confidentiality via hidden field exposure.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 21:40 vuln.today

CVSS changed

Jun 25, 2026 - 19:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 25, 2026 - 15:22 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

K2 ≤ 2.24 contains a mass-assignment defect in the K2 system user plugin plg_user_k2. A Registered Joomla user, by including the field K2UserForm=1 in a standard com_users profile.save POST, can write arbitrary values into the notes, image, and plugins columns of their own row in the #__k2_users table - none of which are exposed by the K2 frontend profile-edit form.

AnalysisAI

Mass-assignment in the K2 Extension for Joomla (versions up to 2.24 per CVE description, up to 2.26 per EUVD-2026-39438) allows any registered Joomla user to overwrite hidden database columns - notes, image, and plugins - in their own #__k2_users row by injecting the K2UserForm=1 parameter into a standard com_users profile.save POST request. The attack is automatable per SSVC assessment, but impact is constrained to the attacker's own user record, with no current active exploitation identified. The plugins column exposure warrants particular scrutiny, as it may influence per-user K2 component behavior in ways beyond simple data tampering.

Technical ContextAI

K2 is a widely-used content component for Joomla CMS that extends the native user system via the plg_user_k2 system plugin (CPE: cpe:2.3:a:getk2.com:k2_extension_for_joomla). This plugin hooks into Joomla's com_users profile.save event to synchronize user data with the #__k2_users database table. CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes (mass assignment) - occurs when a server-side handler accepts and persists arbitrary attacker-supplied field names without validating against an explicit allowlist. Here, the plugin fails to restrict writable columns when the K2UserForm=1 sentinel field is detected in the POST body, allowing the notes, image, and plugins columns to be written with attacker-controlled values, despite these columns being intentionally absent from the K2 frontend profile-edit form. The plugins column is architecturally significant because K2 may read it to determine per-user plugin configuration, meaning arbitrary writes could produce downstream behavioral effects beyond simple data corruption.

RemediationAI

No specific patched version has been confirmed in the available references; the vendor site at https://www.getk2.org/ should be consulted immediately for an official advisory and upgrade path. As a compensating control, administrators can disable the plg_user_k2 system plugin in Joomla's Plugin Manager, which will prevent the mass-assignment path from being triggered - note that this will break K2 user-profile synchronization and may degrade K2 front-end features that depend on per-user data. Alternatively, a Web Application Firewall rule that strips or rejects the K2UserForm parameter from POST requests to the com_users profile.save endpoint would block exploitation without disabling the plugin, though this requires WAF infrastructure to already be in place and must be tested against legitimate K2 profile-save flows. Regardless of mitigation path, administrators should audit the #__k2_users table - specifically the notes, image, and plugins columns - for anomalous values as an indicator of prior exploitation. If open user registration is enabled, consider restricting it until a patch is available.