CVE-2026-48902

CriticalCVSS 9.8/10Last modified Jul 24, 2026

Description

The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-319

Affected software

No affected versions have been published.

Timeline

Published
May 26, 2026
Last modified
Jul 24, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-489036.1Inadequate content filtering within the checkAttribute methods leads to XSS vulnerabilities in various components.CVE-2026-489049.8An improper access check allows privelege escalation through the com_users group editing webservice endpoint.CVE-2026-489056.1Lack of input filtering leads to an XSS vector in the HTML filter code.CVE-2026-489068.1The vulnerability in the Tassos Framework Plugin allows users to delete arbitrary files on the affected sites.CVE-2026-489079.8A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resuCVE-2026-489089.8A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload andCVE-2026-489099.5SP LMS (com_splms) < 4.1.4 by JoomShaper deserializes user-controlled cookie data without validation, enabling an unauthenticated remote attCVE-2026-48915.3A heap-based out-of-bounds read vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via aCVE-2026-489106.5A carefully crafted editing request could trigger an XSS vulnerability on Apache JSPWiki when parsing errors on the markdown renderer, whicCVE-2026-489117.5Insufficient Verification of Data Authenticity vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. A missing CVE-2026-489126.5Improper Input Validation vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. A missing ownership check in tCVE-2026-489137.3Use After Free vulnerability in Apache HTTP Server module mod_http2 when file handles are already exhausted. This issue affects Apache HTTP
CVE-2026-48902: Critical severity, CVSS 9.8 | Vulnix