CVE-2026-75950
Received Received - Intake

Unauthenticated Listing Ownership Takeover in J-BusinessDirectory

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Joomla! Project

Description
Joomla Extension - cmsjunkie.com - Unauthenticated listing ownership takeover in J-BusinessDirectory < 6.2.3 - Ownership could be changed using attacker-supplied company and user IDs, including for listings that already had an owner. 6.2.3 binds the action to the authenticated user and only allows unowned listings.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-75950
EUVD
EUVD-2026-62488

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
cmsjunkie j-businessdirectory to 6.2.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows an unauthenticated attacker to take over ownership of listings in the J-BusinessDirectory Joomla extension versions before 6.2.3. The attacker can change ownership by supplying company and user IDs, even for listings that already have an owner. Version 6.2.3 fixes this by requiring authentication and restricting ownership changes to unowned listings only.

Detection Guidance

To detect this vulnerability, check if your Joomla installation uses J-BusinessDirectory version below 6.2.3. Review server logs for unauthorized ownership changes or requests targeting company and user IDs. No specific commands are provided in the context.

Impact Analysis

If you use J-BusinessDirectory versions before 6.2.3, an attacker could take control of your business listings without your permission. This could lead to unauthorized changes, loss of access to your listings, or misuse of your business information.

Compliance Impact

This vulnerability allows unauthenticated attackers to take ownership of existing listings by changing company and user IDs. This could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's access controls for protected health information.

Mitigation Strategies

Immediately update J-BusinessDirectory to version 6.2.3 or later. Remove or restrict access to any unauthorized ownership changes. Ensure all listings have proper authenticated owners.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75950. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart