CVE-2026-48957: Joomla: broken access control exposes com_privacy data

HIGH

Published July 7, 2026

CISO Take

CVE-2026-48957 is an improper access check in the Joomla core com_privacy web service endpoints that lets any low-privileged authenticated user read privacy datasets they should not be able to see. It scores CVSS 8.8 (network, low complexity, no user interaction), but real-world urgency is moderate today: EPSS is only 0.00423 (65th percentile), it is not in CISA KEV, there is no public exploit or Nuclei template, and CISA SSVC says TRACK. The AI/ML relevance is indirect and the product is not in our tracked AI package catalog, so this matters mainly where a Joomla CMS holds user data that feeds ML datasets, analytics or training pipelines. Apply the Joomla security release referenced in advisory 1065-20260711, restrict or disable the com_privacy web service endpoints until patched, and review API access logs for unusual requests to those endpoints.

Sources:NVDEPSSATLASdeveloper.joomla.org

What is the risk?

Technical severity is high (CVSS 8.8, CWE-284) because the attack is network-reachable, low complexity and needs only low privileges. Exploitation likelihood is currently low to moderate: EPSS 0.00423 (65th percentile), not in KEV, no public exploit, no Nuclei template, SSVC TRACK. Exposure depends on whether the Joomla web services API is enabled and reachable and whether untrusted users hold accounts. AI/ML-specific risk is indirect and limited to data governance exposure.

How does the attack unfold?

Initial Access

Attacker obtains a low-privileged Joomla account on an internet-facing site.

AML.T0012

Exploitation

Attacker calls com_privacy web service endpoints that lack proper access checks.

AML.T0049

Collection

Attacker retrieves privacy datasets containing personal data.

AML.T0036

Impact

Personal data is exposed or altered, creating regulatory risk and possible contamination of downstream ML datasets.

Initial Access

Attacker obtains a low-privileged Joomla account on an internet-facing site.

AML.T0012

Exploitation

Attacker calls com_privacy web service endpoints that lack proper access checks.

AML.T0049

Collection

Attacker retrieves privacy datasets containing personal data.

AML.T0036

Impact

Personal data is exposed or altered, creating regulatory risk and possible contamination of downstream ML datasets.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 37% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade Joomla to the fixed version named in the Joomla Security Centre advisory (core incorrect access control in com_privacy webservice endpoints). 2) Until patched, disable the Joomla web services API or block com_privacy API routes at the WAF or reverse proxy. 3) Audit user accounts and remove unnecessary low-privilege registrations. 4) Review web and API logs for unexpected calls to com_privacy endpoints from non-administrative users. 5) If personal data from Joomla feeds ML datasets, verify dataset provenance and assess whether a breach notification is required.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassData LeakagePrivacy ViolationAPITraining DataAML.T0012- Valid Accounts AML.T0036- Data from Information Repositories AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 10-Data and data governance

ISO 42001

A.7.2-Data for development and enhancement of AI system

NIST AI RMF

MAP 4.1-Risks related to third-party data and software are mapped

Frequently Asked Questions

What is CVE-2026-48957?

Is CVE-2026-48957 actively exploited?

No confirmed active exploitation of CVE-2026-48957 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-48957?

1) Upgrade Joomla to the fixed version named in the Joomla Security Centre advisory (core incorrect access control in com_privacy webservice endpoints). 2) Until patched, disable the Joomla web services API or block com_privacy API routes at the WAF or reverse proxy. 3) Audit user accounts and remove unnecessary low-privilege registrations. 4) Review web and API logs for unexpected calls to com_privacy endpoints from non-administrative users. 5) If personal data from Joomla feeds ML datasets, verify dataset provenance and assess whether a breach notification is required.

What systems are affected by CVE-2026-48957?

This vulnerability affects the following AI/ML architecture patterns: training data pipelines, data governance and privacy tooling, CMS-backed data sources.

What is the CVSS score for CVE-2026-48957?

CVE-2026-48957 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.42%.

What is the AI security impact?

Affected AI Architectures

training data pipelinesdata governance and privacy toolingCMS-backed data sources

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0036Data from Information Repositories

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 10

ISO 42001: A.7.2

NIST AI RMF: MAP 4.1

What are the technical details?

Original Advisory

An improper access check allows unauthorized users to access com_privacy datasets.

Exploitation Scenario

An attacker registers or compromises a low-privileged Joomla account on a site that hosts user data later used for analytics or model training. They call the com_privacy web service endpoints directly, bypassing the missing authorization check, and retrieve or manipulate privacy request datasets containing personal data. The stolen data could be exfiltrated, or altered data could silently flow into downstream ML datasets.

Weaknesses (CWE)

CWE-284Improper Access ControlPrimary CWE-284Improper Access Control

CWE-284 — Improper Access Control: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

[Architecture and Design, Operation] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.