CVE-2026-66916: JoomGallery Auth Bypass Vulnerability

CVE-2026-66916 Overview

CVE-2026-66916 is an access control bypass vulnerability in the JoomGallery extension for Joomla, distributed by joomgalleryfriends.net. The flaw affects JoomGallery versions before 4.4.0. Password-protected gallery categories rely on a password gate enforced only in the HTML view. When a client requests the same category with format=json, the JSON view skips the password check entirely. Unauthenticated attackers can retrieve protected category contents over the network without supplying credentials. The weakness is classified under [CWE-284: Improper Access Control].

Critical Impact
Remote, unauthenticated attackers can enumerate and read metadata from password-protected JoomGallery categories by appending format=json to category view requests.

Affected Products

JoomGallery extension for Joomla, versions prior to 4.4.0
Joomla sites exposing the JoomGallery category view over HTTP or HTTPS
Deployments relying on JoomGallery category passwords to restrict access to gallery content

Discovery Timeline

2026-08-22 - CVE-2026-66916 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-66916

Vulnerability Analysis

JoomGallery supports password-protected categories to restrict browsing of specific gallery sections. The extension enforces the password requirement in the HTML rendering path for the category view. Users hitting the standard category URL are prompted for the configured password before category contents are returned.

The JSON output format for the same category view does not invoke the password check. When an attacker sets format=json on the category request, the controller returns category data without validating the password gate. The result is an authorization decision that depends on the requested output format rather than the resource itself.

Because the network attack vector requires no authentication and no user interaction, exploitation is straightforward with any HTTP client. The scope is limited to confidentiality of category listings and metadata exposed by the JSON view.

Root Cause

The root cause is inconsistent enforcement of access control between output format handlers in the JoomGallery category view. The HTML handler applies the password gate; the JSON handler does not. This is a classic [CWE-284] pattern where security controls are attached to one view path rather than to the underlying resource or controller.

Attack Vector

An unauthenticated attacker sends an HTTP GET request to the JoomGallery category endpoint on a target Joomla site, adding format=json to the query string alongside the target category identifier. The server returns the category payload without evaluating the password gate. Attackers can script this against enumerated category IDs to harvest protected data across a site.

See the JoomGallery Friends website for advisory details and vendor guidance.

Detection Methods for CVE-2026-66916

Indicators of Compromise

Web server access logs showing requests to JoomGallery category URLs containing format=json from unauthenticated clients or unexpected user agents.
Repeated JSON category requests iterating through sequential category IDs, indicating enumeration of protected categories.
Successful HTTP 200 responses to format=json category requests where the same client never completed a password prompt in the HTML view.

Detection Strategies

Alert on any request pattern matching the JoomGallery category route combined with the format=json query parameter targeting categories configured with a password.
Correlate JSON category responses against the site's password-protected category list to identify unauthorized reads.
Baseline legitimate JSON API consumers, then flag new client IP addresses or user agents accessing category JSON endpoints.

Monitoring Recommendations

Ingest Joomla and web server logs into a centralized log platform and tag JoomGallery category endpoints for continuous review.
Track response sizes and status codes on JSON category endpoints to spot bulk data retrieval consistent with scraping.
Monitor for outbound data flows from the web tier following spikes in JSON category traffic.

How to Mitigate CVE-2026-66916

Immediate Actions Required

Upgrade JoomGallery to version 4.4.0 or later, which enforces the password gate on all output formats including JSON.
Audit web server logs for prior format=json requests against password-protected categories to determine if data was accessed.
Rotate or reconsider the sensitivity of content previously stored in password-protected categories on unpatched installations.

Patch Information

The vendor addresses the bypass in JoomGallery 4.4.0. Administrators should install the update through the Joomla extension manager or by downloading the release from the JoomGallery Friends website. Verify the installed version after the upgrade and re-test category access with format=json to confirm the JSON view now enforces the password gate.

Workarounds

Block or rewrite requests to JoomGallery category routes that include format=json at the web server or web application firewall layer until the patch is applied.
Restrict access to the JoomGallery extension to authenticated users only, using Joomla ACLs, where the business model permits.
Remove sensitive content from JoomGallery categories that rely solely on the category password control until version 4.4.0 is deployed.

bash

# Example nginx rule to block JSON format access to JoomGallery category views
# until JoomGallery is upgraded to 4.4.0 or later
if ($arg_option = "com_joomgallery" ) {
    if ($arg_view = "category") {
        if ($arg_format = "json") {
            return 403;
        }
    }
}