CVE-2026-48898

Vulnerability

An improper access check in the com_users batch task within Joomla! CMS allows privilege escalation. The vulnerability affects versions 4.0.0 through 5.4.5 and versions 6.0.0 through 6.1.0 [1]. The necessary conditions for exploitation are not fully detailed in the available references, but the flaw resides in the batch processing functionality of the user management component.

Exploitation

An authenticated attacker with low-level privileges can exploit the flawed access check to escalate their user rights. The precise network position or user interaction required is not specified, but the attack vector is local or remote via the Joomla administrator interface [1]. No public exploit code or detailed steps have been disclosed in the available references.

Impact

Successful exploitation allows an attacker to gain elevated privileges within the Joomla CMS instance, potentially leading to full administrative control. The impact is rated High with low probability, as per the vendor [1]. This could result in unauthorized data access, modification, or further site compromise.

Mitigation

Joomla! has released fixed versions: upgrade to version 5.4.6 or 6.1.1, as published on 2026-05-26 [1]. There are no known workarounds for unpatched installations. Users on unsupported versions should upgrade to a supported release as soon as possible.