The vulnerability stems from an improper access control in the com_users batch task of Joomla! CMS. The flaw permits privilege escalation, allowing an attacker to execute functions normally reserved for administrators. The missing authorization check, identified as CWE-284, can grant unauthorized users elevated privileges across the site. Based on the description, it is inferred that the attacker may need to be authenticated or exploit a misconfiguration to invoke the batch task, although the advisory does not detail explicit authentication prerequisites.

Joomla! CMS as distributed by the Joomla! Project is affected, specifically the sample data plugins that rely on the com_users batch task. No specific version information is available in the advisory, so all installations that include these plugins should be considered potentially vulnerable. Based on the description, it is inferred that the issue applies to any Joomla! CMS deployment that includes the sample data plugins, regardless of the core version.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not available, implying no known active exploitation yet no definitive evidence of exploitation. The flaw can be exploited via a web-based attack that targets the com_users batch task. Based on the description, it is inferred that exploitation would likely require an authenticated user context or that a misconfigured environment could enable unauthenticated access. The risk remains moderate until a vendor fix is applied, and the issue is not listed in CISA KEV.