CVE-2026-75950CWE-284CWE-639broken-access-control

CVE-2026-75950

published August 19, 2026

CVSS
6.9
EPSS
0%
Percentile
33.7
In the wild
Unconfirmed
What it is

Joomla Extension - cmsjunkie.com - Unauthenticated listing ownership takeover in J-BusinessDirectory < 6.2.3 - Ownership could be changed using attacker-supplied company and user IDs, including for listings that already had an owner. 6.2.3 binds the action to the authenticated user and only allows unowned listings.

The record
Technical detail
CVSS
6.9 · NONE
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00406 · 33.7th percentile
Weaknesses
CWE-284 · Improper Access Control; CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-08-19T19:18Z
References (1)
https://www.cmsjunkie.com/ · [email protected]
EPSS history
Timeline
  • 19 AUG 14:40Z
    Joomla Extension - cmsjunkie.com - Unauthenticated listing ownership takeover in J-BusinessDirectory < 6.2.3
    cvelistv5