Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

K2 extension for Joomla lets logged-in users change hidden fields

CVE-2026-48943 · published 4 months ago
Summary

The K2 add‑on for Joomla (versions up to 2.24) lets any registered user send a special request that writes data into hidden database columns such as notes, image and plugins. Those fields are not shown in the normal profile editor, so a user could store unexpected information in their own account. Update the K2 extension to the latest version or apply the vendor’s patch to stop this behaviour.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
getk2.org k2 extension for joomla 1.0-2.26
joomlaworks k2 <= 2.26
cpe:2.3:a:joomlaworks:k2:*:*:*:*:*:joomla\!:*:*
Original advisory text
Joomla Extension - getk2.org - Authenticated user property mass-assignment in K2 extension for Joomla < 2.26
K2 ≤ 2.24 contains a mass-assignment defect in the K2 system user plugin `plg_user_k2`. A Registered Joomla user, by including the field `K2UserForm=1` in a standard `com_users` `profile.save` POST, can write arbitrary values into the `notes`, `image`, and `plugins` columns of their own row in the `#__k2_users` table — none of which are exposed by the K2 frontend profile-edit form.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
6.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-915Improperly Controlled Modification of Dynamically-Determined Object Attributes
Timeline
Published25 Jun 2026
Updated4 Nov 2026
First seen25 Jun 2026
Sources
CVE-2026-48943 · NVD
CVE-2026-48943 · MITRE
Track software like this
Free during beta