SYS::ONLINE
Wasteland.
Briefs779
Issues14
SinceFeb 2026
LIVE
⚡ Active KEV CVE-2026-48899 2026-05-26

CVE-2026-48899: Joomla Privilege Escalation via com_users

"A critical improper access control flaw in Joomla's sample data plugins allows remote attackers to escalate privileges over the network without authentication, scoring 9.8 on CVSS 3.1."

A critical improper access control flaw in Joomla's sample data plugins allows remote attackers to escalate privileges over the network without authentication, scoring 9.8 on CVSS 3.1.

What Is It

CVE-2026-48899 is an improper access control flaw (CWE-284) affecting the Joomla CMS. According to the vendor advisory, an incorrect access check in the sample data plugins permits privilege escalation. NVD's CVSS 3.1 assessment rates the issue 9.8 CRITICAL, with a network attack vector, low complexity, no privileges required, and no user interaction; yielding high impact to confidentiality, integrity, and availability. Joomla's own CVSS 4.0 secondary score is more conservative at 5.3 MEDIUM, with low privileges required and low impact across CIA, reflecting a difference in how each scoring body assesses the access prerequisite and blast radius.

Why It Matters

Joomla powers a substantial share of public-facing websites, making any unauthenticated or low-privilege path to elevated user rights attractive to opportunistic attackers. A successful exploit against the sample data plugins would let an attacker manipulate accounts and roles, which is a direct stepping stone to administrative takeover, content tampering, or use of the site as a foothold for further intrusion. There is no CISA KEV entry for this CVE at this time, so active in-the-wild exploitation has not been confirmed by CISA, but the network-reachable, low-complexity profile means defenders should treat patching as time-sensitive.

What's Vulnerable

Per the NVD CPE configuration, the following Joomla CMS versions are affected:

The issue is tracked by Joomla's security team under advisory 1047, dated 2026-05-15, covering incorrect access control in sample data plugins.

Patch Status

Joomla has shipped fixed releases. Operators should upgrade to:

There is no documented workaround in the supplied advisory, so upgrading is the required remediation. Sites that cannot patch immediately should restrict administrative interfaces at the network layer and audit user accounts for unexpected role changes.

Sources