CVE-2026-105605
Deferred Deferred - Pending Action

IDOR Vulnerability in DJ-Classifieds Joomla Extension

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: Joomla! Project

Description
Joomla Extension - dj-extensions.com - IDOR vulnerability allowing cross-account ad access in DJ-Classifieds < 3.11.3 - A “duplicate my ad” convenience feature on the new-ad form (site/models/additem.php) loaded an existing advert by its raw numeric ID with no check that the ad belonged to the requesting user, and no check of whether it was published, blocked, or still a pending draft. Any logged-in user, regardless of role, could request the new-ad form with another ad’s ID and have that ad’s full content, including the seller’s phone number, address, email, and price, rendered into the response, even for ads that had never been published. Advert IDs are small sequential integers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-105605

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
dj-extensions.com DJ-Classifieds extension for Joomla 1.0-3.11.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an Insecure Direct Object Reference (IDOR) vulnerability in the DJ-Classifieds Joomla extension versions before 3.11.3. It allows any logged-in user to access another user's ad data by manipulating the ad ID parameter in the 'duplicate my ad' feature. The vulnerability exposes sensitive information like seller contact details and pricing.

Detection Guidance

Check for Joomla sites running DJ-Classifieds versions below 3.11.3. Inspect site/models/additem.php for the 'duplicate my ad' feature loading ads by raw numeric ID without user ownership checks. Monitor for unusual ad content access patterns or unauthorized data exposure.

Impact Analysis

If you use DJ-Classifieds on Joomla, attackers could steal your ad data including your contact information and pricing. Sellers may face privacy breaches or unwanted contact. Buyers could be misled by fake or altered ads. The vulnerability affects all published and draft ads regardless of user role.

Compliance Impact

This IDOR vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles. It may cause data breaches exposing personal information, potentially resulting in regulatory fines and reputational damage for organizations handling such data.

Mitigation Strategies

Upgrade DJ-Classifieds to version 3.11.3 or later immediately. Review and restrict access to site/models/additem.php. Implement server-side checks to validate ad ownership and publication status before rendering content. Monitor for suspicious activity related to ad data access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105605. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...