hacKicker

Joomla · Access control

Joomla core: incorrect access control

Identifier CVE-2026-48956

Disclosed

Advisory published 2026

Credit Warisjeet Singh

An improper access check allowed users to display a list of modules in the frontend.

Exhibit 01The evidence: the Joomla advisory, verbatim
developer.joomla.org · CVE-2026-48956published 2026
"An improper access check allows users to display a list
of modules in the frontend."