CVE-2026-48902

Published: May 26, 2026

Modified: Jun 2, 2026

PUBLISHED

The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set.

Vendor	Product	Versions
Joomla! Project	Joomla! CMS	affected `3.9.0-5.4.5` affected `6.0.0-6.1.0`

vendor-advisory

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.