The vulnerability results from an improper access check in Joomla! Core’s com_users batch task, allowing an attacker to elevate privileges on the affected system. Because the batch task can be invoked by users with insufficient permissions, a legitimate user could add or edit user accounts, granting themselves administrative rights or taking over existing accounts. This flaw is categorized as an access control weakness (CWE‑284).

Affected by the Joomla! CMS, part of the Joomla! Project. The advisory lists Joomla! Core but does not specify exact version numbers; therefore all revisions of Joomla! Core that include the com_users component prior to the public patch are potentially vulnerable.

The CVSS score of 8.2 indicates high severity. The EPSS score is not available, and the vulnerability is not yet listed in CISA KEV. The attack vector is not explicitly detailed; it is inferred that the flaw can be exploited remotely via the web interface or locally by a user with access to the site, given that the batch task can be invoked without proper authorization checks. Without a patch, attackers could freely elevate privileges, leading to full system takeover.