This vulnerability (CVE-2026-48947) in Joomla! CMS involves improper access control (CWE-284) that permits privileged users to overwrite media files without having the required editing permissions. The flaw exists in versions =4.1.0-5.4.6 and =6.0.0-6.1.1 of Joomla! CMS. The CVSS 4.0 base score is 6.4, indicating a medium severity level. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported. The vulnerability allows privilege misuse but requires the attacker to already have elevated privileges.

Privileged users can overwrite media files without proper editing permissions, potentially leading to unauthorized content modification. This could affect the integrity of media assets managed by Joomla! CMS. However, since the attacker must already have high privileges, the impact is limited to misuse of existing access rather than privilege escalation or remote code execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is provided, administrators should monitor for updates from the Joomla! Project and consider restricting privileged user access until a fix is available.