CVE-2026-48898 is a critical privilege escalation flaw (CVSS 9.8) in Joomla core. An improper access check in the com_users batch task is affected in versions 4.0.0 through 5.4.5 and 6.0.0 through 6.1.0. Joomla's advisory says to upgrade to 5.4.6 or 6.1.1.
What's affected
Joomla CMS 4.0.0 through 5.4.5 and 6.0.0 through 6.1.0. The fixed versions are 5.4.6 and 6.1.1, with a fixed date of 26 May 2026.
The Joomla project rates the issue high in impact and severity, with a low probability of exploitation. The NVD vector says no privileges are required.
How to check if you're exposed
Open the administrator area and read the version under System, then System Information. Compare it with the affected ranges: 4.0.0 through 5.4.5 and 6.0.0 through 6.1.0.
Also list every Joomla site your team or clients run, including old ones, and review which administrators and API tokens exist.
What to do now
- Upgrade each site to Joomla 5.4.6 or 6.1.1, after a backup.
- Review user groups and look for unexpected new administrators or permission changes.
- Remove inactive accounts and unused API tokens.
- If you cannot upgrade now, restrict the administrator and API paths by IP or behind a VPN.
Why it matters
The class is CWE-284, improper access control. The batch task in the user manager did not properly confirm that the caller was allowed to do what the task does, so a caller could end up with more privileges than they should have. On a content management system, administrator rights mean control of the site and its data.
The record does not mark this CVE as exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list. Two more access control fixes shipped in the same releases, CVE-2026-48899 and CVE-2026-48904, so one upgrade closes all three.
There is no package manifest to scan for this one, so inventory comes first. List every host, instance or device running an affected build. The Gold directory page for CVE-2026-48898 is a handy place to follow later updates.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does the low probability rating mean I can wait?
It lowers the urgency a little. Joomla core upgrades are routine, so apply it with the next window or sooner.
Sources
Last reviewed: 19 October 2026.
