---
id: CVE-2026-48943
title: >-
  K2 ≤ 2.24 contains a mass-assignment defect in the K2 system user plugin
  `plg_user_k2`
summary: >-
  K2 ≤ 2.24 contains a mass-assignment defect in the K2 system user plugin
  `plg_user_k2`. A Registered Joomla user, by including the field `K2UserForm=1`
  in a standard `com_users` `profile.save` POST, can write arbitrary values into
  the `n…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-915
published: '2026-06-25'
updated: '2026-06-28'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-48943'
references:
  - url: 'https://www.getk2.org/'
    label: security@joomla.org
tags:
  - nvd
epss: 0.00303
epssPercentile: 0.2331
ingestedAt: '2026-06-29T13:42:12.010Z'
---

## Overview

K2 ≤ 2.24 contains a mass-assignment defect in the K2 system user plugin `plg_user_k2`. A Registered Joomla user, by including the field `K2UserForm=1` in a standard `com_users` `profile.save` POST, can write arbitrary values into the `notes`, `image`, and `plugins` columns of their own row in the `#__k2_users` table — none of which are exposed by the K2 frontend profile-edit form.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.