Medium severity · published Aug 19, 2026
CVE-2026-75950
Joomla Extension - cmsjunkie.com - Unauthenticated listing ownership takeover in J-BusinessDirectory < 6.2.3
6.9
CVSS
0.4%
EPSS
No
On KEV
Description
Joomla Extension - cmsjunkie.com - Unauthenticated listing ownership takeover in J-BusinessDirectory < 6.2.3 - Ownership could be changed using attacker-supplied company and user IDs, including for listings that already had an owner. 6.2.3 binds the action to the authenticated user and only allows unowned listings.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JE
J-BusinessDirectory extension for Joomla · cmsjunkie.com
1.0.0-6.2.2 · source: vendor
Affected product
JE
J-BusinessDirectory extension for Joomla
cmsjunkie.com
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-75950
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-75950
www.cmsjunkie.com
https://www.cmsjunkie.com/
More from J-BusinessDirectory extension for Joomla
10.0
CVE-2026-75949
Joomla Extension - cmsjunkie.com - Arbitrary file upload / deletion (path traversal) in J-BusinessDirectory < 6.2.3
9.3
CVE-2026-75954
Joomla Extension - cmsjunkie.com - SQL injection in trips search in J-BusinessDirectory < 6.2.3
8.7
CVE-2026-75956
Joomla Extension - cmsjunkie.com - DOS vector in pagination parameter handling in J-BusinessDirectory < 6.2.3
7.5
CVE-2026-75953
Joomla Extension - cmsjunkie.com - Open mail relay in J-BusinessDirectory < 6.2.3
6.9
CVE-2026-75951
Joomla Extension - cmsjunkie.com - Insecure Direct Object Reference (multiple frontend/API actions) in J-BusinessDirectory < 6.2.3