CVE-2026-75950 - Joomla Extension - cmsjunkie.com - Unauthenticated listing ownership takeover in J-BusinessDirectory < 6.2.3 · CoreCVE

Back Back to CVE browser

MEDIUM

Joomla Extension - cmsjunkie.com - Unauthenticated listing ownership takeover in J-BusinessDirectory < 6.2.3

Published Aug 19, 2026

6.9

MEDIUM

CVSS 4.0

EPSS 0.41%

Description

Joomla Extension - cmsjunkie.com - Unauthenticated listing ownership takeover in J-BusinessDirectory < 6.2.3 - Ownership could be changed using attacker-supplied company and user IDs, including for listings that already had an owner. 6.2.3 binds the action to the authenticated user and only allows unowned listings.

Affected products

Vendor Cmsjunkie.com Product J-BusinessDirectory extension for Joomla Default
unaffected
- Version
  1.0.0-6.2.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

J-BusinessDirectory extension for Joomla

unaffected

Version	Status	Constraints
1.0.0-6.2.2	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-284

CWE-639

Authorization Bypass

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-62488
Advisory
https://www.cmsjunkie.com/
product

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-62488		Advisory
https://www.cmsjunkie.com/		product

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner Joomla

Published Aug 19, 2026

Updated Aug 21, 2026

Reserved Aug 18, 2026

Link CVE-2026-75950

CISA Vulnrichment

Updated Aug 21, 2026

Status Deferred

Modified Aug 26, 2026

Link CVE-2026-75950

Severity n/a

Public date n/a

Links CVE-2026-75950

Assigner Joomla

Published Aug 19, 2026

Updated Aug 21, 2026

Exploited since n/a

Link EUVD-2026-62488

EUVD-2026-62488