CVE-2026-66916: Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery < 4.3.1
Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery < 4.3.1 - An unauthenticated access control bypass exists in JoomGallery's category JSON view. When a gallery category is protected with a password, the HTML view correctly enforces the password gate - but the JSON view ( format=json ) skips this check entirely.
Other sources
Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery < 4.4.0- An unauthenticated access control bypass exists in JoomGallery's category JSON view. When a gallery category is protected with a password, the HTML view correctly enforces the password gate - but the JSON view ( format=json ) skips this check entirely.
— NVD
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
JoomGallery versions earlier than 4.3.1 are affected when gallery categories are protected with passwords. The issue is in the category JSON view rather than the HTML view.
What does an attacker need to exploit this issue?
No authentication is required. An attacker needs to request a password-protected category using the JSON format, such as format=json, which bypasses the password check.
Are password-protected categories safe in the default HTML interface?
The HTML view correctly enforces the category password gate. The bypass occurs specifically when the category is accessed through the JSON view.