CVE-2026-75950
MediumCVSS 6.9Summary
Joomla extension J-BusinessDirectory before version 6.2.3 contains an unauthenticated listing ownership takeover vulnerability. Ownership could be changed using attacker-supplied company and user IDs, including for listings that already had an owner. Version 6.2.3 binds the action to the authenticated user and only allows unowned listings.
Risk Assessment
An attacker can take over listings of other users, potentially leading to content modification, fraud, or loss of trust in the platform.
Recommendation
Update J-BusinessDirectory to version 6.2.3 or later, which includes fixes for the vulnerability. Ensure all ownership change actions are properly authorized.
Original NVD description (English source)
Joomla Extension - cmsjunkie.com - Unauthenticated listing ownership takeover in J-BusinessDirectory < 6.2.3 - Ownership could be changed using attacker-supplied company and user IDs, including for listings that already had an owner. 6.2.3 binds the action to the authenticated user and only allows unowned listings.