Quick answers
- Is CVE-2026-48958 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-48958 being exploited in the wild.
- How severe is CVE-2026-48958?
- Informational severity, with a CVSS score of 6.4, published 7 July 2026.
- Which products and versions are affected?
- Joomla! Project Joomla! CMS 4.0.0 - 5.4.6, 6.0.0 - 6.1.1.
- Is there a fix for CVE-2026-48958?
- A patch was published on 2026-07-07: Fixed in versions 5.4.7 and 6.1.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-48958 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-48958?
- Check whether you run Joomla! Project Joomla! CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An incorrect access control vulnerability (CWE-284) exists within the com_fields component's webservice endpoints in Joomla! CMS. The root cause is an improper access check that fails to adequately verify user permissions before allowing the creation of custom fields. An attacker with high-privileged network access can exploit this to inject unauthorized fields into the system. The vulnerability affects versions 4.0.0 through 5.4.6 and 6.0.0 through 6.1.1, and has been patched in versions 5.4.7 and 6.1.2.
Affected products
- Joomla! Project Joomla! CMS 4.0.0 - 5.4.6, 6.0.0 - 6.1.1
Timeline
- 2026-05-05: other: Reported to vendor
- 2026-07-07: patched: Fixed in versions 5.4.7 and 6.1.2
- 2026-07-07: disclosed: NVD publication date