Is CVE-2026-48948 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48948 being exploited in the wild.

How severe is CVE-2026-48948?

Informational severity, with a CVSS score of 6.4, published 7 July 2026.

Which products and versions are affected?

Joomla! Project Joomla! CMS 3.0.0 - 5.4.6, 6.0.0 - 6.1.1.

Is there a fix for CVE-2026-48948?

A patch was published on 2026-07-07: Fixed in versions 5.4.7 and 6.1.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48948 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-48948?

Check whether you run Joomla! Project Joomla! CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48948: Joomla! CMS improper access control in com_contact vCard download

CVE-2026-48948 · Severity: info · CVSS 6.4 · Published 2026-07-07

Joomla! CMS, a popular website management platform, contains a security flaw in its contact management component. This vulnerability allows users with high-level permissions to download contact information (vCards) that they should not be able to access. This could lead to the unauthorized exposure of personal or professional contact details stored within the system.

Technologies: Joomla! Project Joomla! CMS. Vendors: Joomla! Project.

Quick answers

Is CVE-2026-48948 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48948 being exploited in the wild.
How severe is CVE-2026-48948?: Informational severity, with a CVSS score of 6.4, published 7 July 2026.
Which products and versions are affected?: Joomla! Project Joomla! CMS 3.0.0 - 5.4.6, 6.0.0 - 6.1.1.
Is there a fix for CVE-2026-48948?: A patch was published on 2026-07-07: Fixed in versions 5.4.7 and 6.1.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48948 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-48948?: Check whether you run Joomla! Project Joomla! CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper access control vulnerability (CWE-284) exists in the Joomla! CMS 'com_contact' component. The root cause is a failure to correctly validate user permissions during the vCard (.vcf) download process. An attacker with high privileges (PR:H) can exploit this over the network to export contact data that is otherwise restricted or inaccessible to them. The vulnerability affects Joomla! versions 3.0.0 through 5.4.6 and 6.0.0 through 6.1.1. Users are advised to upgrade to versions 5.4.7 or 6.1.2 to remediate the issue.

Affected products

Joomla! Project Joomla! CMS 3.0.0 - 5.4.6, 6.0.0 - 6.1.1

Timeline

2026-05-07: other: Reported date
2026-07-07: patched: Fixed in versions 5.4.7 and 6.1.2
2026-07-07: disclosed: Public disclosure of CVE-2026-48948

References

https://developer.joomla.org/security-centre/1056-20260702-core-incorrect-access-control-in-com-contact-vcf-download.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.