JCE

Unauthenticated RCE in Joomla Content Editor (JCE) Profile Import (CVE-2026-48907)

CVE-2026-48907 is a critical improper access control vulnerability in the JCE extension for Joomla. The profile import workflow (index.php?option=comjce&task=profiles.import) is missing sufficient authorization checks, letting unauthenticated users create new…