The K2 extension for Joomla (versions 1.0 to 2.26) suffers from a CWE-915 mass-assignment vulnerability in the 'plg_user_k2' system user plugin. This flaw allows authenticated Joomla users to manipulate certain database fields ('notes', 'image', 'plugins') in their own K2 user record by submitting a specially crafted POST request with the 'K2UserForm=1' parameter. The vulnerability arises because these fields are not properly protected against modification via the standard profile.save operation, enabling unauthorized attribute changes that are not normally permitted through the frontend interface.

An authenticated Joomla user can modify sensitive fields in their own K2 user database record that are not exposed through the normal user interface. This could lead to unauthorized changes in user profile data stored in the 'notes', 'image', and 'plugins' columns, potentially affecting application behavior or user data integrity. There is no indication of remote code execution or privilege escalation beyond the user's own account.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the profile.save functionality or monitor for unusual POST requests containing the 'K2UserForm=1' parameter. Avoid granting unnecessary permissions to registered users and consider disabling the vulnerable plugin if feasible.