High · 8.2 CVE-2026-48904 EUVD-2026-31875GHSA-x9j9-9cc9-85fc

Joomla! Core - [20260514] - Privilege escalation through com_users webservice endpoints

Published May 26, 2026 · Updated May 27, 2026 · Assigned by Joomla

Description

An improper access check allows privelege escalation through the com_users group editing webservice endpoint.

Vendor	Product	Affected	Fixed
Joomla! Project	Joomla! CMS	4.0.0-5.4.5, 6.0.0-6.1.0	—

CNA	v4.0	8.2
EUVD	v4.0	8.2