This vulnerability in Joomla! CMS (CVE-2026-48948) is categorized as CWE-284 (Improper Access Control). It enables users with high privileges to bypass access restrictions and download vcard exports of contacts managed by the com_contact component, even when those contacts are not supposed to be accessible. The vulnerability affects Joomla! CMS versions 3.0.0 through 5.4.6 and 6.0.0 through 6.1.1. The CVSS 4.0 base score is 6.4, indicating a medium severity with network attack vector, low attack complexity, no user interaction, and high scope and impact on confidentiality, integrity, and availability. There is no vendor-provided patch or official remediation level at this time, and no known exploits in the wild have been reported.

An attacker with high privileges can access and download vcard exports of contacts that should be inaccessible, potentially leading to unauthorized disclosure of contact information. The impact affects confidentiality primarily, with no direct indication of integrity or availability compromise beyond the access control bypass.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user privileges to the minimum necessary and monitor access to the com_contact component to limit exposure.