CVE-2026-48904

Vulnerability

An improper access check in the com_users group editing web service endpoint of Joomla! CMS allows privilege escalation. This affects versions 4.0.0 through 5.4.5 and versions 6.0.0 through 6.1.0 [1]. The vulnerability is present in the webservice endpoint used for editing user groups.

Exploitation

An attacker does not require any special privileges; they only need network access to a Joomla! instance running an affected version. The attack involves sending a crafted HTTP request to the vulnerable web service endpoint to bypass access controls and edit user groups beyond their intended permissions [1].

Impact

Successful exploitation allows an attacker to escalate their privileges, potentially gaining administrative or higher-level access to the Joomla! CMS instance. This could lead to full compromise of the application and its data, including unauthorized content management, user account manipulation, and further system access [1].

Mitigation

The vulnerability is fixed in Joomla! CMS versions 5.4.6 and 6.1.1 [1]. Users should upgrade to these versions or later immediately. No workaround has been provided by the vendor for versions that are not yet patched.