CVE-2026-75950: J-BusinessDirectory Auth Bypass Flaw

CVE-2026-75950 Overview

CVE-2026-75950 is an unauthenticated broken access control vulnerability in the J-BusinessDirectory extension for Joomla, developed by cmsjunkie.com. Versions prior to 6.2.3 allow attackers to change ownership of business listings by supplying arbitrary company and user IDs. The flaw affects listings that already have an assigned owner, enabling full listing takeover without authentication. Version 6.2.3 remediates the issue by binding the ownership action to the authenticated user and restricting it to unowned listings. The weakness is tracked as [CWE-284: Improper Access Control].

Critical Impact
Remote unauthenticated attackers can hijack existing business directory listings by manipulating company and user identifiers, resulting in loss of listing integrity and confidentiality.

Affected Products

J-BusinessDirectory Joomla extension versions prior to 6.2.3
cmsjunkie.com J-BusinessDirectory (all builds below the fixed release)
Joomla sites running vulnerable J-BusinessDirectory installations

Discovery Timeline

2026-08-19 - CVE-2026-75950 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-75950

Vulnerability Analysis

The vulnerability resides in the listing ownership assignment logic of the J-BusinessDirectory Joomla extension. The affected endpoint accepts attacker-controlled company and user identifiers without validating the authenticated session against those identifiers. An unauthenticated remote attacker can invoke the ownership action and set the owner of any listing to an arbitrary user ID. The issue impacts both unowned and already-owned listings, allowing hostile takeover of established business entries.

Ownership of a directory listing typically controls the ability to modify contact details, edit business descriptions, and manage associated content. Successful exploitation lets an attacker inject controlled information into a legitimate listing or transfer that listing to an attacker-controlled account. The extension processes the request through its standard listing action handlers, so no privileged token or session cookie is required.

Root Cause

The root cause is improper access control in the ownership modification workflow. The code trusts client-supplied user and company IDs rather than deriving the acting user from the authenticated session. It also fails to check whether a listing already has an owner before permitting reassignment. The fixed release 6.2.3 binds the operation to the authenticated user context and only permits assignment when a listing has no existing owner.

Attack Vector

Exploitation occurs over the network against the Joomla site hosting J-BusinessDirectory. The attacker crafts an HTTP request to the ownership-handling endpoint, supplying a target company ID and the desired new owner user ID. No authentication, user interaction, or elevated privileges are required. Refer to the CMS Junkie vendor site for advisory details and release notes.

Detection Methods for CVE-2026-75950

Indicators of Compromise

Unexpected changes to the owner_id or equivalent field in the J-BusinessDirectory listing tables.
HTTP POST requests to J-BusinessDirectory ownership endpoints from unauthenticated sessions.
Listings whose contact details, URLs, or descriptions were modified shortly after an ownership change event.

Detection Strategies

Audit the extension's listing database tables for ownership transitions that do not correlate with a valid administrative or user session.
Inspect Joomla and web server access logs for requests to J-BusinessDirectory action URLs containing companyId or user ID parameters from anonymous clients.
Correlate listing update events with the source IP and session state to flag anonymous modifications.

Monitoring Recommendations

Enable Joomla's action logging plugin and forward events to a centralized log store for review.
Alert on ownership-change database events originating from unauthenticated web sessions.
Monitor for spikes in requests targeting J-BusinessDirectory endpoints and review baseline traffic.

How to Mitigate CVE-2026-75950

Immediate Actions Required

Upgrade J-BusinessDirectory to version 6.2.3 or later on all Joomla installations.
Review existing directory listings for unauthorized ownership changes and restore correct owners from backup where needed.
Rotate credentials for any user accounts that were assigned unexpected listings, as they may be attacker-controlled.

Patch Information

The vendor cmsjunkie.com addressed the vulnerability in J-BusinessDirectory 6.2.3. The patched release binds the ownership action to the authenticated user and only permits assignment when a listing has no existing owner. Download the updated extension from the CMS Junkie site and apply it through the Joomla extension manager.

Workarounds

Restrict access to J-BusinessDirectory ownership endpoints at the web server or WAF layer until the patch is applied.
Temporarily disable the J-BusinessDirectory component in Joomla if patching is delayed and the directory feature is non-critical.
Require authentication in front of the Joomla frontend directory pages using web server access controls where feasible.

bash

# Example WAF rule blocking anonymous ownership actions against J-BusinessDirectory
# ModSecurity rule - adjust argument names to match the deployed extension version
SecRule REQUEST_URI "@rx /index\.php\?option=com_jbusinessdirectory" \
    "chain,phase:2,deny,status:403,id:2026075950,\
     msg:'Block unauthenticated J-BusinessDirectory ownership change (CVE-2026-75950)'"
    SecRule ARGS_NAMES "@rx (companyId|userId|owner)" \
        "chain"
        SecRule &REQUEST_COOKIES:/^[a-f0-9]{32}$/ "@eq 0"