An improper access control check in the com_users group editing webservice endpoint of Joomla! CMS allows an attacker to upscale privileges. By exploiting this flaw, an attacker could gain elevated privileges, potentially controlling the entire site and all administrative functions.

This vulnerability affects Joomla! CMS as developed by the Joomla! Project. No specific release versions are listed in the advisory, so all installations using the com_users webservice endpoint could be susceptible.

The CVSS score of 8.2 indicates a high severity and the absence of an EPSS score means that the exploit probability is not quantified. The vulnerability is not currently listed in CISA KEV. The likely attack vector is remote, based on the webservice endpoint; an attacker with network access to the CMS backend can manipulate requests to execute the privilege escalation.