CVE-2026-75950

Joomla Extension - cmsjunkie.com - Unauthenticated listing ownership takeover in J-BusinessDirectory < 6.2.3

State: Published
Severity: 6.9 Medium
Published: Aug 19, 2026
Updated: Aug 21, 2026
Reserved: Aug 18, 2026

Description

Joomla Extension - cmsjunkie.com - Unauthenticated listing ownership takeover in J-BusinessDirectory < 6.2.3 - Ownership could be changed using attacker-supplied company and user IDs, including for listings that already had an owner. 6.2.3 binds the action to the authenticated user and only allows unowned listings.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N	Joomla

Weaknesses

CWE-284 Improper Access Control
CWE-639 (Authorization Bypass Through User-Controlled Key)

Affected Products

Product	Versions
J-BusinessDirectory extension for Joomlacmsjunkie.com	1.0.0-6.2.2Affected

References

https://www.cmsjunkie.com/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.