CVE-2026-48899 is a critical incorrect access control flaw (CVSS 9.8 in NVD) in Joomla core sample data plugins. Unauthorized users can perform actions tied to installing sample data. Affected versions are 4.0.0 through 5.4.5 and 6.0.0 through 6.1.0. Upgrade to Joomla 5.4.6 or 6.1.1.
What's affected
Joomla CMS 4.0.0 through 5.4.5 and 6.0.0 through 6.1.0, fixed in 5.4.6 and 6.1.1.
A note on the record: the NVD description repeats the com_users batch task text from CVE-2026-48898, but the Joomla advisory this CVE points to is titled Incorrect Access Control in sample data plugins. We follow the Joomla advisory. It rates severity moderate, impact high and probability moderate, while NVD scores 9.8.
How to check if you're exposed
Open the administrator area and read the version under System, then System Information. Compare it with the affected ranges: 4.0.0 through 5.4.5 and 6.0.0 through 6.1.0.
Also list every Joomla site your team or clients run, including old ones, and review which administrators and API tokens exist.
What to do now
- Upgrade each site to Joomla 5.4.6 or 6.1.1, after a backup.
- Review user groups and look for unexpected new administrators or permission changes.
- Remove inactive accounts and unused API tokens.
- If you cannot upgrade now, restrict the administrator and API paths by IP or behind a VPN.
Why it matters
The class is CWE-284, improper access control. According to Joomla, an improper access check lets unauthorized users perform actions related to installing sample data. Sample data features exist to make demo content, and they should be reachable only by administrators.
The gap between the moderate project rating and the 9.8 NVD score is worth noting: the vector assumes no login and full impact, while the project judged the real effect lower. The record does not mark this CVE as exploited, and it is not on the CISA Known Exploited Vulnerabilities list.
There is no package manifest to scan for this one, so inventory comes first. List every host, instance or device running an affected build. The Gold directory page for CVE-2026-48899 is a handy place to follow later updates.
Quick check
Which score should I follow?
Use the higher score for urgency and the advisory text for understanding. Either way the fix is the same upgrade.
Sources
Last reviewed: 19 October 2026.
