By vendor

Joomla vulnerabilities

Known CVEs affecting Joomla products, prioritized by severity, with SEC.co remediation and detection guidance.

11 published vulnerabilities

• CVE-2026-48948HIGH 8.8

  A Joomla vulnerability allows authenticated users to bypass access controls and download contact card (vcard) exports for contacts they should not be able to access. An attacker with a user account can exploit this to retrieve sensitive contact information that has been restricted by administrators, potentially exposing personal data, organizational structures, or confidential contact details.

• CVE-2026-48958HIGH 8.8

  A vulnerability in Joomla's webservices functionality allows authenticated users to bypass access controls and create custom fields they shouldn't have permission to modify. An attacker with valid user credentials can exploit this to inject unauthorized fields into the system, potentially altering application behavior or exfiltrating sensitive information. The flaw stems from improper validation of user permissions before allowing field creation through the API.

• CVE-2026-48955MEDIUM 6.5

  CVE-2026-48955 is a medium-severity access control flaw in Joomla that allows authenticated users to view workflow stage and transition details they should not be able to see. An attacker with a valid login—even with limited permissions—can bypass authorization checks to inspect sensitive workflow configuration and state information. This is not a remote unauthenticated attack, but rather a privilege escalation within the platform.

• CVE-2026-48949MEDIUM 6.1

  A Joomla vulnerability allows attackers to inject malicious scripts into multi-factor authentication (MFA) management pages. Because user input isn't properly validated before being displayed, an attacker can craft a malicious link that, when clicked by an authenticated administrator, executes JavaScript in their browser context. This could allow theft of session tokens, modification of MFA settings, or other administrative actions performed without the victim's knowledge.

• CVE-2026-48950MEDIUM 6.1

  CVE-2026-48950 is a cross-site scripting (XSS) vulnerability in Joomla's template file management component (com_templates). An attacker can inject malicious scripts into file names or metadata that are displayed without proper sanitization, allowing them to steal session cookies, redirect users, or perform actions on behalf of an administrator viewing the file management interface. The vulnerability requires user interaction—specifically, an administrator must visit the vulnerable page—but affects the security of the entire Joomla installation.

• CVE-2026-48951MEDIUM 6.1

  A cross-site scripting (XSS) vulnerability exists in Joomla due to insufficient escaping of user input in modal return layouts across various components. An attacker can craft a malicious link or form that, when clicked by an authenticated or unauthenticated user, injects arbitrary JavaScript into the page. This script executes in the victim's browser within the context of the Joomla site, potentially allowing theft of session tokens, credential harvesting, or malware distribution.

• CVE-2026-48952MEDIUM 6.1

  A cross-site scripting (XSS) vulnerability exists in Joomla's installer component update list view. The vulnerability arises from insufficient sanitization of user-supplied input, allowing an attacker to inject malicious scripts that execute in the context of an administrator's browser session. An authenticated or unauthenticated attacker can craft a malicious link containing JavaScript code; when an admin clicks it and accesses the installer update list, the injected script runs with the privileges of that administrator account. This could lead to unauthorized actions, session hijacking, or further compromise of the Joomla installation.

• CVE-2026-48953MEDIUM 6.1

  A cross-site scripting (XSS) vulnerability exists in Joomla's generic image output layout due to insufficient output escaping. An attacker can craft a malicious link containing JavaScript code that executes in a victim's browser when they view or interact with image content. The vulnerability requires user interaction and affects the confidentiality and integrity of user sessions, though it does not impact availability.

• CVE-2026-48954MEDIUM 6.1

  A cross-site scripting (XSS) vulnerability has been discovered in Joomla's language override feature. The vulnerability stems from inadequate input validation, allowing an attacker to inject malicious scripts that execute in users' browsers. An attacker would need to trick a user into visiting a specially crafted link or interacting with a compromised page, but no special privileges are required to exploit this flaw. The vulnerability affects the confidentiality and integrity of user sessions and data, though it does not directly impact system availability.

• CVE-2026-48956MEDIUM 5.0

  Joomla! contains an access control weakness that allows authenticated users to view a list of installed modules through the frontend interface. While an attacker needs valid login credentials to exploit this, the improper permission check exposes internal system information that should remain hidden from regular users. This information disclosure could help an attacker plan more targeted attacks against the application.

• CVE-2026-48947MEDIUM 4.9

  CVE-2026-48947 is a medium-severity access control flaw in Joomla that allows privileged users to overwrite media files even when they lack explicit editing permissions. The vulnerability stems from an improper check during file operations, enabling privilege escalation within the application's permission model. While the issue requires an authenticated attacker with elevated privileges, it can lead to unauthorized modification of critical media assets.