CVE-2026-75952 Overview
CVE-2026-75952 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the J-BusinessDirectory extension for Joomla, developed by cmsjunkie.com. The flaw affects versions prior to 6.2.3. The extension omits anti-CSRF tokens on numerous AJAX and state-changing tasks, including contact and quote forms, cart operations, bookmarks, uploads, messages, AI text generation, and several administrator actions.
Administrator actions exposed include application installation, demo-data wipe, cache and statistics archive operations, payment notification dispatch, and mobile push notifications. Frontend exploitation requires a registered user or listing-owner session, while administrator exploitation requires an authenticated backend admin session.
Critical Impact
Attackers can force authenticated Joomla users or administrators to perform unauthorized state-changing actions by tricking them into visiting a malicious page, enabling data manipulation and destructive admin operations.
Affected Products
- Joomla J-BusinessDirectory extension by cmsjunkie.com
- Versions prior to 6.2.3
- Deployments exposing both frontend user and backend administrator interfaces
Discovery Timeline
- 2026-08-19 - CVE-2026-75952 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-75952
Vulnerability Analysis
The vulnerability stems from missing CSRF token validation across many state-changing endpoints in J-BusinessDirectory. Joomla provides a built-in token mechanism through JSession::checkToken() or Session::checkToken(), but the affected endpoints do not enforce token verification before processing requests. This omission allows cross-origin requests to trigger sensitive actions in the context of an authenticated victim.
The attack surface spans both frontend and backend. Frontend endpoints handle listing contact forms, quote requests, cart state, bookmarks, file uploads, messaging between users, and AI-driven text generation for listings. Backend endpoints cover application installation, demo-data wipe, cache and statistics archive management, payment notification dispatch, and mobile push notification delivery.
EPSS data indicates a low probability of near-term exploitation, but the breadth of affected tasks increases the potential impact where exploitation succeeds.
Root Cause
The root cause is failure to validate anti-CSRF tokens on AJAX and form submission handlers. Joomla components typically enforce this through JHtml::_('form.token') in forms and server-side token verification in controllers. J-BusinessDirectory omitted these checks on multiple tasks, treating session authentication as sufficient authorization.
Attack Vector
An attacker crafts a malicious webpage or email containing HTML forms or JavaScript that submit forged requests to the target Joomla site. The victim, already authenticated as a registered user, listing owner, or administrator, visits the attacker-controlled resource. The browser attaches the victim's session cookies to the forged request, and the J-BusinessDirectory endpoint processes it without token validation.
Frontend exploitation targets listing owners to manipulate cart items, bookmarks, uploads, or trigger AI generation. Administrator exploitation is more destructive, allowing attackers to install applications, wipe demo data, clear caches or statistics archives, and dispatch payment or push notifications on behalf of the admin.
Exploitation code is not required beyond a standard HTML form auto-submitting to the vulnerable endpoint. Refer to the CMS Junkie Blog for vendor advisory details.
Detection Methods for CVE-2026-75952
Indicators of Compromise
- Unexpected state changes in J-BusinessDirectory records such as bookmarks, cart contents, or listing uploads not initiated by the account owner.
- Administrator log entries showing application installations, demo-data wipes, or cache archive operations without a corresponding admin session activity trail.
- HTTP referer headers pointing to external domains on requests to J-BusinessDirectory task endpoints.
Detection Strategies
- Inspect Joomla access logs for POST requests to J-BusinessDirectory task URLs lacking a valid token parameter or with cross-origin referer values.
- Correlate administrator actions with expected admin console activity to identify anomalous state changes.
- Monitor for spikes in AJAX task invocations from authenticated sessions immediately after external referrals.
Monitoring Recommendations
- Enable verbose logging on the Joomla component router and administrator panel to capture task parameters and referer headers.
- Alert on any request to J-BusinessDirectory administrator tasks such as app install, wipe demo data, or archive operations that originate from non-admin browser contexts.
- Track failed and successful token validation counts once the patch is applied to detect ongoing exploitation attempts.
How to Mitigate CVE-2026-75952
Immediate Actions Required
- Upgrade J-BusinessDirectory to version 6.2.3 or later on all Joomla installations.
- Force re-authentication of active administrator sessions after upgrading to invalidate any hijacked session state.
- Audit recent administrator actions such as application installs and demo-data wipes to confirm they were authorized.
Patch Information
Upgrade to J-BusinessDirectory version 6.2.3 or newer. The patch introduces anti-CSRF token validation on the previously unprotected AJAX and state-changing tasks. Refer to the CMS Junkie product page for release notes and download instructions.
Workarounds
- Restrict administrator panel access by source IP through web server or reverse proxy rules until the patch is applied.
- Require administrators to use a dedicated browser profile that does not visit untrusted sites while sessions are active.
- Enforce short session timeouts for both frontend registered users and backend administrators to reduce the exploitation window.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
