OrdaSoft Joomla Gallery CVE-2026-88855

Requires an authenticated Joomla account holding the core.manage permission scoped to the OrdaSoft Gallery component (a delegated content-management right, not full administrator). The affected OrdaSoft Joomla Gallery extension (free or paid) must be installed on a Joomla site at a version below 6.2.7, and the attacker must reach the saveGallery() form-handling endpoint. Limiting factors: no unauthenticated path (PR required), so exploitation depends on the site delegating gallery-management rights to non-fully-trusted users; the value of the attack (hash disclosure) is highest where such delegated accounts exist. No special non-default configuration beyond having the vulnerable extension enabled, and no user interaction is needed.

This is a genuine, high-severity SQL injection (CWE-89) but its risk is gated by authentication. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H, score 8.6) correctly reflects network reachability, low complexity, no user interaction, and full triad impact - SQL injection over the concatenated category_names[]/catOrderIds/ordering fields yields full read/write to the Joomla database, including UNION extraction of #__users password hashes. The one signal moderating urgency is privileges: exploitation requires an authenticated user holding the core.manage permission. The vendor rated this PR:H, but the description itself stresses core.manage is 'a permission scoped to managing one gallery component, not administrator-wide trust' - that framing better matches a lower/moderate privilege (PR:L), which would RAISE the real-world risk, not lower it, since a non-admin content manager can dump admin hashes. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no evidence of active exploitation - treat this as a patch-on-schedule priority rather than an emergency. Net: technically serious (hash disclosure → potential admin takeover) but exploitation is bounded to accounts that already have delegated gallery-management rights.

An attacker with (or who has obtained) a Joomla account granted the core.manage permission over the OrdaSoft Gallery component submits a crafted saveGallery() request whose category_names[]/catOrderIds/ordering fields carry a UNION-based SQL payload. Because those values are concatenated into SQL without quoting or integer casting, the payload executes and extracts #__users password hashes, which can then be cracked to escalate toward full administrator access. No public exploit code is identified at time of analysis, and no user interaction is required.