CVE-2026-75950: Joomla Extension - cmsjunkie.com - Unauthenticated listing ownership takeover in J-BusinessDirectory < 6.2.3

Q: Which installations are affected?

J-BusinessDirectory versions earlier than 6.2.3 are affected. Version 6.2.3 changes the ownership action to bind it to the authenticated user and to allow only unowned listings.

Q: What could an attacker do?

An unauthenticated attacker could supply company and user IDs to change a listing's ownership. This could affect listings that already had an owner.

Q: What is the immediate mitigation?

Upgrade J-BusinessDirectory to version 6.2.3. The provided information does not describe a temporary workaround for installations that cannot yet be upgraded.

Published Aug 19, 2026

Updated

Joomla Extension - cmsjunkie.com - Unauthenticated listing ownership takeover in J-BusinessDirectory < 6.2.3 - Ownership could be changed using attacker-supplied company and user IDs, including for listings that already had an owner. 6.2.3 binds the action to the authenticated user and only allows unowned listings.

Affected Software

1 affected component

J-BusinessDirectory<6.2.3

Event History

Aug 19, 2026

CVE Published

via MITRE·02:40 PM

Data Sourced

via MITRE·02:40 PM

DescriptionWeakness

Frequently Asked Questions

Which installations are affected?

J-BusinessDirectory versions earlier than 6.2.3 are affected. Version 6.2.3 changes the ownership action to bind it to the authenticated user and to allow only unowned listings.

What could an attacker do?

An unauthenticated attacker could supply company and user IDs to change a listing's ownership. This could affect listings that already had an owner.

What is the immediate mitigation?

Upgrade J-BusinessDirectory to version 6.2.3. The provided information does not describe a temporary workaround for installations that cannot yet be upgraded.