CVE-2019-25762: Joomla! JoomProject Information Disclosure

CVE-2019-25762 Overview

CVE-2019-25762 is an information disclosure vulnerability in the Joomla! component JoomProject version 1.1.3.2. The flaw allows unauthenticated remote attackers to enumerate sensitive user information through the public projects endpoint. By crafting a request to index.php with the parameters option=com_jpprojects&view=projects&tmpl=component&format=json, an attacker retrieves a JSON response containing user IDs, full names, and email addresses. The weakness is categorized under CWE-359: Exposure of Private Personal Information to an Unauthorized Actor.

Critical Impact
Unauthenticated attackers can harvest user identities and email addresses from any Joomla site running JoomProject 1.1.3.2, enabling targeted phishing, credential stuffing, and account enumeration campaigns.

Affected Products

Joomla! Component JoomProject 1.1.3.2
Joomla! installations using the com_jpprojects extension
Any deployment exposing the projects view via the JSON format handler

Discovery Timeline

2026-06-19 - CVE-2019-25762 published to the National Vulnerability Database
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2019-25762

Vulnerability Analysis

The vulnerability resides in the projects view of the com_jpprojects Joomla extension. The component exposes a JSON output handler that returns user records without enforcing authentication or access control. Any client capable of issuing HTTP requests can query the endpoint and parse the structured response. The exposed fields include numeric user identifiers, display names, and email addresses associated with project members.

The issue is purely a confidentiality flaw. It does not directly modify data or grant code execution, but the disclosed data is highly useful for follow-on attacks. Attackers commonly chain user enumeration with password spraying, phishing, and Joomla administrator account targeting.

Root Cause

The root cause is missing authorization on the JSON view of the projects controller. The component returns user metadata as part of the project listing without verifying that the requester holds an authenticated session or appropriate role. The tmpl=component parameter strips the standard site chrome, while format=json invokes the machine-readable output path that includes user fields intended for internal use.

Attack Vector

Exploitation requires only network access to the vulnerable Joomla site. An attacker sends an unauthenticated HTTP GET request to index.php?option=com_jpprojects&view=projects&tmpl=component&format=json and parses the JSON body. The response contains an array of project members along with their id, name, and email attributes. No interaction, credentials, or special headers are required. The request pattern is described in the VulnCheck Advisory on Joomla and the public proof of concept at Exploit-DB #46121.

Detection Methods for CVE-2019-25762

Indicators of Compromise

HTTP requests to index.php containing option=com_jpprojects combined with view=projects and format=json
Repeated GET requests to the JSON endpoint from a single source address indicating enumeration
User-Agent strings associated with automated scanners or scripting libraries hitting the projects endpoint
Outbound phishing emails sent shortly after to addresses exposed by the endpoint

Detection Strategies

Inspect web server access logs for query strings matching the com_jpprojects projects JSON pattern
Deploy a Web Application Firewall (WAF) rule that flags or blocks unauthenticated access to format=json views of com_jpprojects
Correlate spikes in requests to the JoomProject component against authentication and email gateway events

Monitoring Recommendations

Forward Joomla and web server logs to a centralized analytics platform for query-string analysis
Baseline normal traffic to JoomProject endpoints and alert on volume anomalies
Monitor mailbox abuse reports for phishing campaigns referencing user names disclosed by the component

How to Mitigate CVE-2019-25762

Immediate Actions Required

Restrict public access to index.php?option=com_jpprojects&view=projects&format=json via web server or WAF rules
Audit the Joomla installation for the presence of JoomProject 1.1.3.2 and inventory exposed user data
Notify users whose data may have been disclosed and enforce password resets where account abuse is suspected
Review project member lists and remove unnecessary accounts to reduce exposure

Patch Information

No vendor advisory URL is listed in the CVE record. Administrators should consult the JoomBoost Security Resource and the Joomla Extension Management Tool for the latest JoomProject release and upgrade beyond version 1.1.3.2. Until a patched version is confirmed, treat the component as exposing sensitive data by default.

Workarounds

Block requests containing option=com_jpprojects with format=json at the reverse proxy or WAF layer
Disable the JoomProject component if it is not in active use and remove its files from the Joomla installation
Place the Joomla administration and project areas behind an authenticating proxy or VPN where feasible
Apply rate limiting on the index.php endpoint to slow large-scale enumeration attempts

bash

# Example nginx rule to block the vulnerable JSON endpoint
location = /index.php {
    if ($args ~* "option=com_jpprojects.*format=json") {
        return 403;
    }
}