The vulnerability is an improper access control (CWE‑284) that permits a user with low privileges to change the task type of existing scheduler tasks in Joomla! CMS. By altering the task type, the attacker could modify the behavior of scheduled actions, potentially affecting site functionality or enabling further undesired operations if those tasks interact with sensitive data or processes.

Any Joomla! CMS installation that includes the com_scheduler component is affected; no specific versions are identified in the CVE data.

The CVSS score of 6.4 indicates moderate severity. EPSS data is not available, so the precise likelihood of exploitation cannot be quantified. The flaw is not listed in the CISA KEV catalog. Exploitation requires the attacker to be authenticated as a user with low privileges and to access the scheduler interface, making the attack vector remote through standard web authentication.