This vulnerability is a classic Cross‑Site Request Forgery flaw, rated CWE‑352, where the activation endpoint of the com_users component does not enforce a CSRF token. An attacker can craft a malicious request that, when submitted by an authenticated administrator, can activate or promote a user account without permission. This can lead to unauthorized administrator accounts or privilege elevation, compromising the confidentiality and integrity of the site. The CVSS score of 4.6 indicates a moderate severity of the flaw.

The vulnerability affects Joomla! CMS installations that expose the com_users activation endpoint. No specific version range is listed, so any Joomla! deployment that includes the com_users component and does not apply a CSRF token check on the activation route may be vulnerable.

The CVSS rating of 4.6 reflects the requirement of a valid administration session for exploitation. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating that widespread exploitation has not been observed. Based on the description, it is inferred that the attack vector is a web‑based CSRF: a malicious page could send the forged activation request while an administrator is logged in, causing the server to activate or promote a user account without any additional authentication or confirmation.