CVE-2026-48948: Joomla! Auth Bypass Vulnerability

CVE-2026-48948 Overview

CVE-2026-48948 is an improper access control vulnerability in the Joomla! com_contact component. The flaw allows authenticated users to download vCard (.vcf) exports of contacts they are not authorized to view. The access check that gates the standard contact view is not enforced on the vCard download endpoint. Joomla published a security advisory tracked as 20260702 describing the issue as incorrect access control in the com_contact vCard download path. The vulnerability is classified under [CWE-284: Improper Access Control].

Critical Impact
Authenticated users with any privileged role can bypass contact visibility restrictions and exfiltrate contact records via vCard downloads, resulting in unauthorized disclosure of contact data managed by Joomla!.

Affected Products

Joomla! CMS – com_contact core component
Joomla! installations exposing contact vCard downloads
See the Joomla Security Advisory 2026-07-02 for version ranges

Discovery Timeline

2026-07-07 - CVE-2026-48948 published to NVD
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-48948

Vulnerability Analysis

The vulnerability resides in the vCard export functionality of Joomla!'s com_contact component. Joomla! enforces view-level access control on standard contact pages using access levels and category permissions. The vCard download handler does not consistently apply the same access checks before returning contact data as a .vcf file.

An authenticated user can request the vCard export URL for a contact whose category or access level would normally block direct viewing. The server returns the contact record serialized as a vCard, disclosing fields such as name, email address, telephone number, and postal address.

The issue is scoped to information disclosure. It does not enable modification, deletion, or privilege escalation directly. However, harvested contact data can support downstream phishing, social engineering, and reconnaissance against internal staff or partners referenced in restricted contact categories.

Root Cause

The root cause is a missing authorization check in the vCard download controller path of com_contact. The controller retrieves the requested contact by identifier and generates the vCard response without re-evaluating whether the requesting user meets the access level configured on the contact or its category. The standard front-end view enforces this check; the export route does not, leading to inconsistent enforcement across handlers for the same resource.

Attack Vector

Exploitation requires network access to the Joomla! site and an authenticated session with elevated privileges, as indicated by the PR:H attribute in the CVSS vector. The attacker enumerates or guesses numeric contact identifiers and issues a request to the com_contact vCard endpoint with a format=vcf (or equivalent) parameter. The server responds with the restricted contact's vCard payload. No user interaction and no additional exploitation primitives are required. No public proof-of-concept exploit is currently listed in the enriched data, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities catalog.

For technical specifics, see the Joomla Security Advisory 2026-07-02.

Detection Methods for CVE-2026-48948

Indicators of Compromise

Web server access log entries requesting com_contact URLs with format=vcf or paths ending in .vcf from authenticated sessions.
Successful 200 OK responses returning text/x-vcard or text/vcard content types to users whose roles should not permit access to the referenced contact.
Sequential or enumerated id= parameter values against the contact vCard endpoint from a single session.

Detection Strategies

Correlate authenticated user identifiers with the access levels of the contacts referenced in vCard download requests and flag mismatches.
Alert on bursts of vCard download requests originating from a single account within a short interval, which suggests enumeration.
Baseline normal vCard download volume per role and alert on deviations that exceed expected activity.

Monitoring Recommendations

Ingest Joomla! access logs and application logs into a centralized logging or SIEM platform and retain them for post-incident review.
Monitor the com_contact route for anomalous query parameter patterns and repeated requests to non-public contact identifiers.
Track authentication events for accounts that begin issuing vCard export requests outside of their normal usage profile.

How to Mitigate CVE-2026-48948

Immediate Actions Required

Apply the Joomla! security update referenced in the Joomla Security Advisory 2026-07-02 to all affected instances.
Review the account inventory and disable or reduce privileges for stale or unnecessary authenticated accounts.
Audit web server logs for prior vCard download requests targeting restricted contact identifiers.

Patch Information

Joomla! addressed the improper access check by adding the missing authorization enforcement to the com_contact vCard download handler so that the same access level and category checks used by the standard contact view are applied to the export path. Administrators should update to the fixed Joomla! release listed in the Joomla Security Advisory 2026-07-02.

Workarounds

Disable the com_contact component if vCard export functionality is not required by the site.
Restrict access to the vCard download route at the web server or reverse proxy layer until the patch is applied.
Move sensitive contacts into categories that are not managed by com_contact or remove them from the site until remediation is complete.

bash

# Example Apache rule to block com_contact vCard downloads until patched
<LocationMatch "/index\.php">
    <If "%{QUERY_STRING} =~ /option=com_contact/ && %{QUERY_STRING} =~ /format=vcf/">
        Require all denied
    </If>
</LocationMatch>