CVE-2026-75950 in J-BusinessDirectory Extension
Summary
by MITRE • 08/19/2026
Joomla Extension - cmsjunkie.com - Unauthenticated listing ownership takeover in J-BusinessDirectory < 6.2.3 - Ownership could be changed using attacker-supplied company and user IDs, including for listings that already had an owner. 6.2.3 binds the action to the authenticated user and only allows unowned listings.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified in J-BusinessDirectory versions prior to 6.2.3 represents a critical failure in access control logic within the Joomla content management system ecosystem. This flaw, specifically categorized as an Unauthenticated Listing Ownership Takeover, stems from insufficient validation of user permissions when processing requests related to business directory listings. The core technical issue lies in the application's handling of ownership assignment parameters during unauthenticated or poorly authenticated sessions. Specifically, the software fails to verify that the entity requesting a change in listing ownership is actually the legitimate owner or an authorized administrator with sufficient privileges to perform such administrative actions. Instead, the system accepts attacker-supplied company and user identifiers without rigorous cross-referencing against existing database records of current ownership status. This allows any external actor to arbitrarily assign themselves as the new owner of a business listing by manipulating input fields that transmit these specific identifiers in HTTP requests targeting the relevant API endpoints or form submissions associated with the extension.
From an operational perspective, this vulnerability enables attackers to seize control over digital assets within the directory structure without needing valid credentials for the target accounts. The impact is severe because it compromises the integrity of user-generated content and business profiles that are central to the functionality of J-BusinessDirectory. Attackers can take ownership of listings that already have designated owners, effectively displacing legitimate users from their own data entries. This capability facilitates a range of malicious activities including defacement, insertion of phishing links or malware within the listing descriptions, alteration of contact information for fraudulent purposes, and general disruption of business operations dependent on accurate online presence. The ability to modify ownership unauthenticated means that even if user accounts are secured with strong passwords, their associated data assets remain vulnerable to takeover through this specific application-level logic flaw rather than traditional credential theft methods.
The remediation strategy implemented in version 6.2.3 addresses the root cause by enforcing strict binding of actions to authenticated users and restricting ownership changes exclusively to listings that do not yet have an assigned owner. This approach ensures that once a listing is claimed, only the verified account holder or privileged administrators can modify its status through proper authentication mechanisms. To mitigate this risk in affected systems, immediate upgrade to version 6.2.3 or later is required. For organizations unable to update immediately due to compatibility constraints with other Joomla extensions, temporary mitigations include implementing Web Application Firewall rules that monitor for anomalous patterns in ownership change requests and restricting access to the specific API endpoints involved until patches are applied. Additionally, administrators should audit existing listings for signs of unauthorized ownership changes and reset passwords for affected user accounts as a precautionary measure against potential subsequent exploitation vectors such as session hijacking or credential stuffing if other weaknesses exist within the broader Joomla installation.
This vulnerability aligns with Common Weakness Enumeration category CWE-284 Improper Access Control, where insufficient restrictions are applied to ensure authorized actors can access resources and unauthorized actors cannot. It also maps to MITRE ATT&CK techniques related to Account Manipulation, specifically T1098 which covers account manipulation through various methods including adding credentials or modifying permissions. The exploitation of this flaw does not require complex binary analysis or memory corruption but relies entirely on logical flaws in the application's business logic layer, highlighting the importance of rigorous input validation and authorization checks even for seemingly simple administrative functions like changing ownership records. Security practitioners should prioritize patching this extension to prevent unauthorized data modification and maintain trust within the directory community by ensuring that only legitimate owners retain control over their published information.