K2 ≤ 2.24 contains a mass-assignment defect in the K2 system user plugin `plg_user_k2`. A Registered Joomla user, by including the field `K2UserForm=1` in a standard `com_users` `profile.save` POST, can write arbitrary values into the `notes`, `image`, and `plugins` columns of their own row in the `#__k2_users` table — none of which are exposed by the K2 frontend profile-edit form.
References
| Link | Resource |
|---|---|
| https://www.getk2.org/ | Product |
Configurations
History
26 Jun 2026, 17:43
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:joomlaworks:k2:*:*:*:*:*:joomla\!:*:* | |
| References | () https://www.getk2.org/ - Product | |
| First Time |
Joomlaworks
Joomlaworks k2 |
25 Jun 2026, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
25 Jun 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-06-25 16:16
Updated : 2026-06-28 19:16
NVD link : CVE-2026-48943
Mitre link : CVE-2026-48943
CVE.ORG link : CVE-2026-48943
JSON object : View
Products Affected
joomlaworks
- k2
CWE
CWE-915
Improperly Controlled Modification of Dynamically-Determined Object Attributes