CVE-2026-48901 describes a vulnerability in Joomla! CMS where the InputFilter::getInstance() method fails to include a security sensitive parameter in the instance cache key. This omission can cause improper caching behavior that may expose sensitive data. The affected versions are 4.0.0 up to 5.4.5 and 6.0.0 up to 6.1.0. The vulnerability is classified under CWE-524 (Information Exposure Through Caching). The CVSS v3.1 base score is 7.5 with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

The vulnerability can lead to unauthorized disclosure of sensitive information due to improper caching of security sensitive parameters. The confidentiality impact is high, while integrity and availability are not affected. This could allow remote attackers to gain access to sensitive data without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor Joomla! Project advisories for updates. No specific temporary mitigations are provided in the available data.