EUVD-2026-62492
GHSA-5hvc-jq76-66vg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Joomla site with J-BusinessDirectory
-
DeliveryEnumerate exposed frontend or API endpoints
-
ExploitSubmit request with manipulated object reference ID
-
ExecutionBypass ownership check
-
ImpactRead or modify another user's directory record
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | No authentication is required - the CVSS 4.0 vector (PR:N/UI:N/AV:N/AC:L) confirms unauthenticated remote exploitation against any default installation of J-BusinessDirectory prior to version 6.2.3. The primary condition is that the target Joomla site must have the J-BusinessDirectory extension installed and active. Exploitation is limited to low-impact per-record read/write operations (VC:L/VI:L) and does not affect availability. The attack spans multiple frontend and API actions, so no single non-default feature flag is required - the extension being enabled is sufficient. |
| Impact | The CVSS 4.0 score of 6.9 (Medium) reflects a realistic threat profile: network-reachable (AV:N), no complexity barrier (AC:L), no privileges required (PR:N), and no user interaction (UI:N), with limited confidentiality and integrity impact (VC:L/VI:L) and no availability impact. The tag 'Authentication Bypass' elevates concern, suggesting the IDOR may effectively circumvent access controls on protected operations, not merely expose read access. EPSS data was not provided, so exploitation probability cannot be quantified. The vulnerability is absent from CISA KEV, and no POC code is known - the real-world risk at this time appears moderate, but the unauthenticated, network-accessible attack vector means any public-facing Joomla site running this extension is exposed without any prerequisite. The limited C/I impact metrics (both L, not H) suggest per-record data exposure rather than full database compromise. |
| Exploit ScenarioDerived | An unauthenticated attacker identifies a Joomla site running J-BusinessDirectory by inspecting page source or response headers. The attacker then sends crafted HTTP requests to vulnerable frontend or API endpoints, substituting their own object ID with sequentially incremented or guessed IDs belonging to other users' business listings, modifying or reading records they do not own. No public exploit code exists at time of analysis, but the low-complexity CVSS vector indicates this is straightforward to replicate from the description alone. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 19, 2026
Insecure Direct Object Reference (IDOR) in J-BusinessDirectory versions below 6.2.3 allows unauthenticated remote attackers to access and modify business directory records belonging to other users across multiple frontend and API endpoints. The CVSS 4.0 vector (PR:N, AV:N, AC:L) confirms no authentication is required, meaning any internet-connected user can exploit the flaw against a default installation. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
RemediationAI
Upgrade J-BusinessDirectory to version 6.2.3 or later, which resolves the IDOR conditions across the affected frontend and API endpoints. The vendor's changelog and release files are accessible at https://www.cmsjunkie.com/. If an immediate upgrade is not feasible, administrators should restrict public access to the affected API endpoints at the web server or WAF layer - specifically, block or rate-limit unauthenticated requests to J-BusinessDirectory API routes and frontend action endpoints. This is a partial mitigation only, as it may break legitimate functionality; test thoroughly before deploying. There is no evidence of a vendor-provided workaround short of upgrading.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
J-BusinessDirectory is a commercial Joomla extension by cmsjunkie.com (CPE: cpe:2.3:a:cmsjunkie.com:j-businessdirectory_extension_for_joomla:*:*:*:*:*:*:*:*) that provides business listing and directory functionality on Joomla CMS sites. The root cause is CWE-639 (Authorization Through User-Controlled Key), a class of IDOR where the application uses attacker-controllable values - such as numeric IDs or GUIDs - as direct references to backend objects without verifying that the requesting user has authorization to access or modify them. The flaw spans multiple frontend views and API actions, meaning object references are accepted and processed without server-side ownership checks across the extension's surface area.
Know when J Businessdirectory Extension For Joomla gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Network-reachable, no privileges or interaction required per CVSS 4.0 baseline; unchanged scope with limited per-record confidentiality and integrity impact only.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
DescriptionCVE.org
Joomla Extension - cmsjunkie.com - Insecure Direct Object Reference (multiple frontend/API actions) in J-BusinessDirectory < 6.2.3
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Arbitrary file upload and deletion in the J-BusinessDirectory extension for Joomla (versions before 6.2.3) lets remote a
SQL injection in the J-BusinessDirectory extension for Joomla (by cmsjunkie.com) before version 6.2.3 lets remote attack
Denial-of-service in the J-BusinessDirectory Joomla extension (all versions before 6.2.3) allows unauthenticated remote
Open mail relay in the J-BusinessDirectory Joomla extension (versions 1.0.0-6.2.2) allows unauthenticated remote attacke
Unauthenticated listing ownership takeover in J-BusinessDirectory (a Joomla extension by cmsjunkie.com) prior to version
Reflected XSS and XML injection in the J-BusinessDirectory Joomla extension (cmsjunkie.com, versions prior to 6.2.3) exp
Cross-site request forgery (CSRF) in the J-BusinessDirectory Joomla extension (versions prior to 6.2.3 by cmsjunkie.com)
Exploit-DB