CVE-2026-48902

No fix known EPSS <1%CVSS 9.8

The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set.

Published 2026-05-26 · CVE record · OSV

Products: Joomla! Project Joomla! CMS