This vulnerability in Joomla! CMS arises from an improper access check in the com_users group editing webservice endpoint, classified under CWE-284 (Improper Access Control). It allows an attacker to escalate privileges by bypassing access restrictions. Affected versions include 4.0.0 to 5.4.5 and 6.0.0 to 6.1.0. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no user interaction, and high impact on integrity. The vendor has not yet provided an official fix or remediation level, and no known exploits have been reported.

Successful exploitation could allow an unauthenticated attacker to escalate privileges within the Joomla! CMS, potentially leading to unauthorized administrative access and control over the affected system. This could compromise the integrity of the CMS and its hosted content. However, there are currently no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should monitor Joomla! Project advisories closely. No vendor-provided mitigation or temporary fix is currently available.