This vulnerability (CVE-2026-48900) in Joomla! CMS arises from an improper access control weakness (CWE-284) that permits low privileged users to modify the task types of scheduler tasks. Affected versions include 4.1.0 to 5.4.5 and 6.0.0 to 6.1.0. The CVSS 4.0 base score is 6.4 (medium severity), reflecting network attack vector, low privileges required, and limited impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently provided by the vendor. The vulnerability is publicly known but not yet exploited in the wild.

The impact of this vulnerability is that low privileged users can alter scheduler task types, which may lead to unauthorized changes in scheduled operations within Joomla! CMS. This could affect the integrity and expected behavior of scheduled tasks but does not directly indicate full system compromise or data exposure. The CVSS score of 6.4 suggests a moderate risk level.

Patch status is not yet confirmed — check the Joomla! Project vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider restricting user privileges to trusted users only and monitor scheduler task configurations for unauthorized changes.