CVE-2026-48904 is a critical privilege escalation flaw (CVSS 9.8) in Joomla core. An improper access check in the com_users group editing web service endpoint affects versions 4.0.0 through 5.4.5 and 6.0.0 through 6.1.0. Joomla fixes it in 5.4.6 and 6.1.1.
What's affected
Joomla CMS 4.0.0 through 5.4.5 and 6.0.0 through 6.1.0. Fixed in 5.4.6 and 6.1.1.
Joomla rates the severity moderate, impact high and probability low. NVD scores it 9.8. The flaw is in the web services API, so sites that expose the API are the main concern.
How to check if you're exposed
Open the administrator area and read the version under System, then System Information. Compare it with the affected ranges: 4.0.0 through 5.4.5 and 6.0.0 through 6.1.0.
Also list every Joomla site your team or clients run, including old ones, and review which administrators and API tokens exist.
Also check whether the web services API is enabled and reachable from the internet.
What to do now
- Upgrade each site to Joomla 5.4.6 or 6.1.1, after a backup.
- Review user groups and look for unexpected new administrators or permission changes.
- Remove inactive accounts and unused API tokens.
- If you cannot upgrade now, restrict the administrator and API paths by IP or behind a VPN.
Why it matters
The class is CWE-284, improper access control. The endpoint used to edit user groups did not check properly who was calling. Because groups carry permissions, changing a group can mean granting rights to yourself or others.
Three Joomla core access issues were fixed together, CVE-2026-48898, CVE-2026-48899 and this one, so treat the upgrade as covering all of them. The record does not mark this CVE as exploited, and it is not on the CISA Known Exploited Vulnerabilities list.
There is no package manifest to scan for this one, so inventory comes first. List every host, instance or device running an affected build. The Gold directory page for CVE-2026-48904 is a handy place to follow later updates.
Quick check
Do I need the API enabled to be exposed?
The flaw is in an API endpoint, so exposure is lower where the API is off. Upgrading removes the question.
Sources
Last reviewed: 19 October 2026.
