This vulnerability (CVE-2026-48958) in Joomla! CMS involves an improper access check (CWE-284) that permits unauthorized users to create custom fields through webservices endpoints. The CVSS 4.0 base score is 6.4, indicating medium severity, with network attack vector, low integrity impact, and high scope and security impact. The affected versions include =4.0.0-5.4.6 and =6.0.0-6.1.1. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

Unauthorized users with high privileges can create custom fields via webservices endpoints, potentially leading to unauthorized configuration changes within Joomla! CMS. The integrity impact is low, but the vulnerability affects the security scope and impact significantly. This could affect the trustworthiness of the CMS configuration and data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is documented, administrators should monitor Joomla! Project advisories for updates and consider restricting access to webservices endpoints until a fix is available.