CVE-2026-75951 Overview
CVE-2026-75951 is an Insecure Direct Object Reference (IDOR) vulnerability affecting the J-BusinessDirectory extension for Joomla, developed by CMS Junkie. The flaw exists in multiple frontend and API actions across versions prior to 6.2.3. Unauthenticated attackers can manipulate object identifiers in requests to access or modify records belonging to other users. The vulnerability is tracked under CWE-639: Authorization Bypass Through User-Controlled Key.
Critical Impact
Unauthenticated network-based access to directory records through manipulated object references, resulting in low confidentiality and integrity impact across affected Joomla sites.
Affected Products
- J-BusinessDirectory Joomla extension versions prior to 6.2.3
- Joomla sites using CMS Junkie J-BusinessDirectory frontend components
- Joomla sites exposing J-BusinessDirectory API actions
Discovery Timeline
- 2026-08-19 - CVE-2026-75951 published to NVD
- 2026-08-19 - Last updated in NVD database
Technical Details for CVE-2026-75951
Vulnerability Analysis
The J-BusinessDirectory extension exposes multiple frontend and API endpoints that accept object identifiers as request parameters. The endpoints resolve the referenced records and process actions on them without verifying that the requester owns or has permission to interact with those objects. Attackers can iterate or guess identifier values to read, modify, or otherwise act on records belonging to other users.
The issue is classified as [CWE-639]. It stems from missing authorization checks rather than from broken authentication. The attack requires no privileges, no user interaction, and executes over the network. According to the EPSS model, the probability of exploitation in the next 30 days is 0.295% (22.2 percentile).
Root Cause
The extension trusts client-supplied object identifiers passed to frontend controllers and API actions. Server-side handlers query and act on the target record without confirming that the current session, token, or account is authorized for that specific object. This authorization gap spans multiple actions rather than a single endpoint.
Attack Vector
An unauthenticated attacker sends crafted HTTP requests to the vulnerable Joomla site. By substituting identifier parameters in frontend URLs or API calls with values referencing other users' records, the attacker triggers actions on those records. No verified public proof-of-concept code is available. See the CMS Junkie site for vendor information on J-BusinessDirectory.
Detection Methods for CVE-2026-75951
Indicators of Compromise
- Unexpected modifications to J-BusinessDirectory listings, reviews, or user records without corresponding session activity from the record owner
- HTTP access logs showing sequential or enumerated id parameter values against com_jbusinessdirectory endpoints
- API requests to J-BusinessDirectory action handlers from unauthenticated sessions targeting resources tied to other accounts
Detection Strategies
- Inspect Joomla and web server logs for repeated requests to J-BusinessDirectory frontend controllers with varying numeric identifiers from the same source IP
- Correlate object modification events with the authenticated session that performed them and flag mismatches
- Deploy web application firewall rules that alert on unauthenticated requests to sensitive J-BusinessDirectory API actions
Monitoring Recommendations
- Enable verbose access logging on index.php?option=com_jbusinessdirectory requests including query parameters
- Track the version of J-BusinessDirectory installed across all Joomla instances and alert when versions below 6.2.3 are detected
- Monitor for spikes in 200-response traffic to J-BusinessDirectory endpoints from anonymous sources
How to Mitigate CVE-2026-75951
Immediate Actions Required
- Upgrade J-BusinessDirectory to version 6.2.3 or later on all Joomla installations
- Audit J-BusinessDirectory records for unauthorized modifications since the extension was installed
- Restrict access to J-BusinessDirectory administrative and API endpoints through IP allowlisting where feasible
Patch Information
The vendor addressed the vulnerability in J-BusinessDirectory 6.2.3. Refer to the CMS Junkie site for the release and change history.
Workarounds
- Disable the J-BusinessDirectory extension until the upgrade to 6.2.3 can be completed
- Place the affected endpoints behind authentication at the web server or reverse proxy layer
- Apply WAF rules that reject requests to J-BusinessDirectory action handlers lacking a valid authenticated session
# Verify installed J-BusinessDirectory version on a Joomla site
grep -i 'version' administrator/components/com_jbusinessdirectory/jbusinessdirectory.xml
# Disable the component pending upgrade (via CLI)
php cli/joomla.php extension:disable com_jbusinessdirectory
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
