This vulnerability (CVE-2026-48957) in Joomla! CMS involves improper access control (CWE-284) that permits unauthorized users to access the com_privacy datasets. The issue arises from an insufficient access check mechanism, allowing users without proper privileges to retrieve data they should not access. The CVSS 4.0 base score is 6.4, indicating a medium severity level. The affected versions explicitly include =4.0.0-5.4.6 and =6.0.0-6.1.1. There is no vendor advisory or patch information available at this time, and no known exploits have been reported in the wild.

Unauthorized users can access sensitive privacy-related datasets within Joomla! CMS due to improper access control. This could lead to exposure of private data managed by the com_privacy component. The vulnerability does not require user interaction and has a low attack complexity, but requires high privileges, limiting the scope of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to Joomla! CMS administrative interfaces and monitor for unusual access attempts to the com_privacy component. Avoid granting unnecessary high privileges to users.