J-BusinessDirectory CVE-2026-75950

No authentication is required - the CVSS 4.0 vector confirms PR:N and the description explicitly labels this an unauthenticated takeover. The extension must be installed and active on a Joomla site, and the site must be network-accessible to the attacker. The attacker must know or enumerate valid company and user IDs; company IDs are likely publicly visible through directory browsing, reducing this to a minor reconnaissance step. Exploitation is limited strictly to J-BusinessDirectory listing ownership - it does not provide access to Joomla admin, other extensions, or the underlying server. Listings without an existing owner can be trivially claimed; listings with an existing owner are also vulnerable prior to 6.2.3, as the guard for already-owned listings was absent. No special operating system, database, or Joomla core version requirement is indicated by available data.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms fully unauthenticated, network-accessible exploitation with no attack complexity or special prerequisites, placing this in the highest-exploitability tier despite the moderate overall score of 6.9 driven by limited impact (VC:L/VI:L). Real-world risk is constrained by the niche deployment footprint of J-BusinessDirectory - this is a specialized Joomla extension, not a core platform component - but any installation exposing a public-facing business directory is directly vulnerable. EPSS data was not provided in the available intelligence, and no KEV listing exists, suggesting no observed widespread exploitation at time of analysis. No public exploit code has been identified, though the attack is mechanically trivial given that no authentication is required. Even a mid-sized municipal IT team in walbrzych operating a local business directory on Joomla should treat this as a moderate-to-high priority, particularly where directory listing integrity underpins business operations or public trust. The integrity impact - legitimate business listing ownership silently reassigned to an attacker - could facilitate phishing, reputation damage, or misdirection of customers without triggering obvious availability alerts.

An unauthenticated attacker visits a Joomla site running J-BusinessDirectory prior to 6.2.3, identifies target listing IDs by browsing the public directory (company IDs are typically enumerable from URL parameters or listing pages), then sends a crafted HTTP POST or GET request to the ownership-assignment endpoint with the attacker's own user ID and the victim listing's company ID. The server processes the request without validating the requestor's session or the listing's current ownership state, silently transferring control of the listing to the attacker. No exploit code or tooling beyond a standard HTTP client is required.