CVE-2026-117544: Joomla Extension - jdownloads.com - IDOR allowing restricted file downloads in jDownloads < 4.1.8
Joomla Extension - jdownloads.com - IDOR allowing restricted file downloads in jDownloads < 4.1.8 - The otherfileid parameter could reference another download’s file without fully enforcing the target download’s access restrictions. This allowed files to be delivered to users who were not authorised to access the target download.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
jDownloadsto a version that resolves this vulnerability.Fixed in 4.1.8
Event History
Frequently Asked Questions
Who can exploit this issue?
A user who can submit a request containing the other_file_id parameter may be able to retrieve a file associated with a different download when they are not authorised for that target download.
What information could be exposed?
Restricted files attached to target downloads may be delivered to unauthorised users if the target download's access restrictions are not fully enforced.
Which versions are affected?
jDownloads versions earlier than 4.1.8 are affected.