{"id":"CVE-2026-48943","aliases":["EUVD-2026-39438","GHSA-x6c6-vg4w-8r3r"],"status":"published","title":"Joomla Extension - getk2.org - Authenticated user property mass-assignment in K2 extension for Joomla \u003c 2.26","description":"K2 ≤ 2.24 contains a mass-assignment defect in the K2 system user plugin `plg_user_k2`. A Registered Joomla user, by including the field `K2UserForm=1` in a standard `com_users` `profile.save` POST, can write arbitrary values into the `notes`, `image`, and `plugins` columns of their own row in the `#__k2_users` table — none of which are exposed by the K2 frontend profile-edit form.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00303,"percentile":0.2334,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-915"],"published":"2026-06-25T15:22:50Z","modified":"2026-10-25T22:10:00Z","products":[{"vendor":"getk2.com","product":"k2 extension for joomla"},{"vendor":"getk2.org","product":"k2 extension for joomla"},{"vendor":"joomlaworks","product":"k2"}],"references":[{"url":"https://www.getk2.org/","tags":["product","Product"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48943"},{"url":"https://www.getk2.org"},{"url":"https://github.com/advisories/GHSA-x6c6-vg4w-8r3r"}],"sources":{"cve":[{"id":"CVE-2026-48943","title":"Joomla Extension - getk2.org - Authenticated user property mass-assignment in K2 extension for Joomla \u003c 2.26","description":"K2 ≤ 2.24 contains a mass-assignment defect in the K2 system user plugin `plg_user_k2`. A Registered Joomla user, by including the field `K2UserForm=1` in a standard `com_users` `profile.save` POST, can write arbitrary values into the `notes`, `image`, and `plugins` columns of their own row in the `#__k2_users` table — none of which are exposed by the K2 frontend profile-edit form.","status":"published","published":"2026-06-25T15:22:50.562Z","modified":"2026-10-05T16:06:16.825Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-915"],"updated_at":"2026-11-02T14:19:47.998488Z"}],"euvd":[{"id":"EUVD-2026-39438","description":"K2 ≤ 2.24 contains a mass-assignment defect in the K2 system user plugin `plg_user_k2`. A Registered Joomla user, by including the field `K2UserForm=1` in a standard `com_users` `profile.save` POST, can write arbitrary values into the `notes`, `image`, and `plugins` columns of their own row in the `#__k2_users` table — none of which are exposed by the K2 frontend profile-edit form.","status":"published","published":"2026-06-25T15:22:50Z","modified":"2026-10-05T16:06:16Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T17:27:39.819382Z"}],"ghsa":[{"id":"GHSA-x6c6-vg4w-8r3r","title":"K2 ≤ 2.24 contains a mass-assignment defect in the K2 system user plugin `plg_user_k2`. A...","description":"K2 ≤ 2.24 contains a mass-assignment defect in the K2 system user plugin `plg_user_k2`. A Registered Joomla user, by including the field `K2UserForm=1` in a standard `com_users` `profile.save` POST, can write arbitrary values into the `notes`, `image`, and `plugins` columns of their own row in the `#__k2_users` table — none of which are exposed by the K2 frontend profile-edit form.","status":"published","published":"2026-06-25T18:30:39Z","modified":"2026-06-25T21:32:34Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-915"],"updated_at":"2026-11-02T15:08:59.978633Z"}],"nvd":[{"id":"CVE-2026-48943","description":"K2 ≤ 2.24 contains a mass-assignment defect in the K2 system user plugin `plg_user_k2`. A Registered Joomla user, by including the field `K2UserForm=1` in a standard `com_users` `profile.save` POST, can write arbitrary values into the `notes`, `image`, and `plugins` columns of their own row in the `#__k2_users` table — none of which are exposed by the K2 frontend profile-edit form.","status":"published","published":"2026-06-25T16:16:36.737Z","modified":"2026-10-25T22:10:00.15Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-915"],"updated_at":"2026-11-02T14:12:26.045561Z"}]}}