This vulnerability in Joomla! CMS arises from an improper access check in the com_users group editing webservice endpoint. It allows an attacker without privileges to escalate their privileges by exploiting the access control weakness. Affected versions include 4.0.0 to 5.4.5 and 6.0.0 to 6.1.0. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no user interaction, and high impact on integrity via privilege escalation. No vendor remediation level or patch information is currently available.

Successful exploitation could allow an unauthenticated attacker to escalate privileges within the Joomla! CMS, potentially leading to unauthorized administrative access or control over the system. This could compromise the integrity of the affected Joomla! installations. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the com_users webservice endpoint and monitor for suspicious activity related to group editing operations. Avoid exposing the affected Joomla! versions to untrusted networks where possible.