CVE-2026-48943 is a CWE-915 mass-assignment vulnerability affecting the K2 extension for Joomla up to version 2.26. The vulnerability exists in the plg_user_k2 system user plugin, where a registered user can manipulate the K2UserForm parameter in a com_users profile.save POST request to write arbitrary data into the notes, image, and plugins columns of their own row in the #__k2_users database table. This occurs because the plugin does not properly control modification of dynamically-determined object attributes, allowing unauthorized attribute assignment that is not exposed through the frontend user interface.

An attacker with a registered Joomla user account can modify sensitive attributes in their K2 user record that are normally not accessible via the frontend profile form. This could lead to unauthorized changes in user metadata stored in the notes, image, and plugins fields, potentially impacting application behavior or user data integrity. The vulnerability does not allow privilege escalation or denial of service based on the available information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No official patch or workaround is currently documented.