PT-2026-79526 · Joomla · Joomgallery
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
JoomGallery versions prior to 4.3.1
Description
An unauthenticated access control bypass exists in the category JSON view. While the HTML view correctly enforces password protection for gallery categories, the JSON view fails to perform this check when the
format parameter is set to json.Recommendations
Update to version 4.3.1 or later.
Avoid using the
format parameter with the value json in category views until the update is applied.Fix
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Joomgallery