CVE-2026-48902
A security flaw in Joomla allows the system to create unencrypted HTTP links for password and username resets when a specific security setting is not enabled. This occurs because the system fails to force secure HTTPS connections for these sensitive reset links.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Users running the Joomla content management system who have not explicitly enabled the 'Force SSL' setting.
Real-world impact
An attacker monitoring network traffic could intercept the unencrypted reset links, allowing them to hijack user accounts by resetting passwords.
Why this severity
This vulnerability is rated critical because it can be exploited remotely over the internet without any user interaction or authentication, potentially leading to a total loss of confidentiality, integrity, and availability.
What to do about it
- ›Ensure the 'Force SSL' flag is explicitly set in the system configuration.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- May 26, 2026 · May 26, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 11d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- developer.joomla.org/security-centre/1050-202605…vendor advisory