# CVE-2026-48948: Joomla! CMS improper access control in com_contact vCard download

Source: https://junglewise.ai/threats/cve-2026-48948-joomla-cms-improper-access-control-in-com-contact-vcard-download  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2026-48948 · Severity: info · CVSS 6.4 · Published 2026-07-07

Joomla! CMS, a popular website management platform, contains a security flaw in its contact management component. This vulnerability allows users with high-level permissions to download contact information (vCards) that they should not be able to access. This could lead to the unauthorized exposure of personal or professional contact details stored within the system.

Technologies: [Joomla! Project Joomla! CMS](https://junglewise.ai/threats/technologies/joomla-cms). Vendors: [Joomla! Project](https://junglewise.ai/threats/vendors/joomla-project).

## Quick answers

**Is CVE-2026-48948 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48948 being exploited in the wild.

**How severe is CVE-2026-48948?** Informational severity, with a CVSS score of 6.4, published 7 July 2026.

**Which products and versions are affected?** Joomla! Project Joomla! CMS 3.0.0 - 5.4.6, 6.0.0 - 6.1.1.

**Is there a fix for CVE-2026-48948?** A patch was published on 2026-07-07: Fixed in versions 5.4.7 and 6.1.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48948 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-48948?** Check whether you run Joomla! Project Joomla! CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper access control vulnerability (CWE-284) exists in the Joomla! CMS 'com_contact' component. The root cause is a failure to correctly validate user permissions during the vCard (.vcf) download process. An attacker with high privileges (PR:H) can exploit this over the network to export contact data that is otherwise restricted or inaccessible to them. The vulnerability affects Joomla! versions 3.0.0 through 5.4.6 and 6.0.0 through 6.1.1. Users are advised to upgrade to versions 5.4.7 or 6.1.2 to remediate the issue.

## Affected products

- Joomla! Project Joomla! CMS 3.0.0 - 5.4.6, 6.0.0 - 6.1.1

## Timeline

- 2026-05-07: other: Reported date
- 2026-07-07: patched: Fixed in versions 5.4.7 and 6.1.2
- 2026-07-07: disclosed: Public disclosure of CVE-2026-48948

## References

- [https://developer.joomla.org/security-centre/1056-20260702-core-incorrect-access-control-in-com-contact-vcf-download.html](https://developer.joomla.org/security-centre/1056-20260702-core-incorrect-access-control-in-com-contact-vcf-download.html)

## Related threats

- [Joomla! CMS improper access control in com_fields webservice](https://junglewise.ai/threats/cve-2026-48958-joomla-cms-improper-access-control-in-com-fields-webservice)
- [Joomla! CMS improper access control in com_workflow](https://junglewise.ai/threats/cve-2026-48955-joomla-cms-improper-access-control-in-com-workflow)
- [Joomla! CMS XSS in language override feature](https://junglewise.ai/threats/cve-2026-48954-joomla-cms-xss-in-language-override-feature)
- [Joomla! CMS XSS in com_templates file management view](https://junglewise.ai/threats/cve-2026-48950-joomla-cms-xss-in-com-templates-file-management-view)