CVE-2026-48947 - Joomla! Core - [20260701] - Incorrect Access Control in com_media webservice endpoints

MEDIUM

Joomla! Core - [20260701] - Incorrect Access Control in com_media webservice endpoints

Published Jul 7, 2026

6.4

MEDIUM

CVSS 4.0

EPSS 0.33%

An improper access check allows privileged users to overwrite media files without editing permissions.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

unaffected

Version	Status	Constraints
4.1.0-5.4.6	affected	-
6.0.0-6.1.1	affected	-

No remediation recorded yet.

Weaknesses (1)

CWE-284

Link	Providers	Tags
https://developer.joomla.org/security-centre/1055-20260701-core-incorrect-access-control-in-com-media-webservice-endpoints.html		vendor-advisoryVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42069		Advisory