CVE-2026-48899 - Joomla! Core - [20260515] - Incorrect Access Control in sample data plugins

MEDIUM

Joomla! Core - [20260515] - Incorrect Access Control in sample data plugins

Published May 26, 2026

5.3

MEDIUM

CVSS 4.0

EPSS 0.42%

An improper access check allows privilege escalation through the com_users batch task.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

unaffected

Version	Status	Constraints
4.0.0-5.4.5	affected	-
6.0.0-6.1.0	affected	-

No remediation recorded yet.

Weaknesses (1)

CWE-284

Link	Providers	Tags
https://developer.joomla.org/security-centre/1047-20260515-core-incorrect-access-control-in-sample-data-plugins.html		vendor-advisoryVendor Advisory

No recorded changes yet.

Sources

Status PUBLISHED

Assigner Joomla

Published May 26, 2026

Updated May 27, 2026

Reserved May 26, 2026

Updated May 26, 2026

Status Analyzed

Modified Jul 24, 2026

Severity n/a

Public date n/a