CVE-2026-78084: SP Property Gallery Auth Bypass Vulnerability

CVE-2026-78084 Overview

CVE-2026-78084 is a missing access control vulnerability [CWE-284] in the JoomShaper SP Property extension for Joomla, affecting versions prior to 4.1.4. The gallery image management controller tasks omit authorization checks and Cross-Site Request Forgery (CSRF) token validation. Unauthenticated attackers can invoke file removal actions with arbitrary path strings or upload files of unverified types. The flaw exposes hosted Joomla sites running the SP Property real estate extension to file tampering and content manipulation.

Critical Impact
Attackers can remotely delete arbitrary files or upload unverified file types on Joomla sites running SP Property before version 4.1.4, without authentication.

Affected Products

JoomShaper SP Property extension for Joomla
SP Property versions prior to 4.1.4
Joomla sites deploying the affected gallery management controller

Discovery Timeline

2026-09-10 - CVE-2026-78084 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-78084

Vulnerability Analysis

SP Property is a JoomShaper real estate extension for Joomla that includes a gallery image management module. The controller tasks responsible for handling image operations do not enforce authorization checks before executing sensitive actions. The same controller tasks also skip CSRF token validation, so requests are accepted without verifying that they originate from an authenticated session.

Two distinct attack behaviors follow from the missing checks. First, file removal actions accept arbitrary path strings, which allows deletion of files outside the intended gallery scope. Second, upload actions do not verify the type of files supplied by the caller, opening the extension to unrestricted file upload. The combination of missing access control and missing input validation on file paths and file types produces both an integrity and an availability impact on affected sites.

Root Cause

The root cause is a broken access control pattern in the gallery controller. Handler methods are exposed as Joomla task endpoints without corresponding permission checks or token validation. The controller trusts caller-supplied parameters, including file paths and file content, without validating that the caller is authorized or that the input matches an expected format.

Attack Vector

The vulnerability is exploitable over the network with low attack complexity and no authentication or user interaction. An attacker sends crafted HTTP requests to the gallery management task endpoints of a vulnerable SP Property installation. The requests either invoke the delete task with a chosen path string or invoke the upload task with an unverified file. Because CSRF tokens are not required, the requests can also be triggered through a victim browser visiting a hostile page.

No verified proof-of-concept code is public. See the JoomShaper SP Property Extension product page for vendor details.

Detection Methods for CVE-2026-78084

Indicators of Compromise

Unexpected HTTP POST or GET requests to SP Property gallery controller tasks from unauthenticated sessions
Web server access logs showing gallery delete or upload task invocations with unusual path or filename parameters
New files with non-image extensions in SP Property gallery upload directories
Missing image files or gallery entries that were not removed by administrators

Detection Strategies

Inspect Joomla access logs for requests to SP Property gallery task= endpoints lacking a valid session cookie or CSRF token
Alert on file writes to gallery directories where the file extension is not a permitted image type
Baseline the SP Property gallery directory and detect deletions or additions that do not correlate with administrator activity

Monitoring Recommendations

Forward Joomla and web server logs to a centralized analytics platform for correlation with authentication events
Enable file integrity monitoring on the SP Property extension directory and any writable upload paths
Track outbound requests from the web server that may indicate execution of uploaded content

How to Mitigate CVE-2026-78084

Immediate Actions Required

Upgrade the JoomShaper SP Property extension to version 4.1.4 or later
Audit the SP Property gallery upload directory for unexpected files and remove any unauthorized content
Review web server and Joomla logs for prior invocations of the gallery delete and upload tasks by unauthenticated clients
Rotate administrator credentials if evidence of exploitation is found

Patch Information

The vendor has addressed the missing access control in SP Property version 4.1.4. Administrators should update through the Joomla extensions manager or by installing the latest package from the JoomShaper SP Property Extension page. Confirm that the installed version is 4.1.4 or later after the update.

Workarounds

Restrict access to Joomla administrator and component endpoints using a Web Application Firewall (WAF) rule set that requires authentication for SP Property gallery tasks
Disable the SP Property extension until the patched version is installed if immediate upgrade is not feasible
Enforce file type restrictions at the web server or WAF layer for uploads targeting the SP Property gallery paths

bash

# Example Apache configuration restricting executable file uploads in gallery directories
<Directory "/var/www/html/images/sp_property/gallery">
    <FilesMatch "\.(php|phtml|phar|pl|py|jsp|asp|sh|cgi)$">
        Require all denied
    </FilesMatch>
    Options -ExecCGI
    AddHandler cgi-script .none
</Directory>