CVE Watch22 ago 2026

CVE-2026-66916

Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery < 4.4.0- An unauthenticated ac

CVSS

—

Sin CVSS

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 22 ago 2026 · Última mod.: 22 ago 2026 · CWE-284

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery < 4.4.0- An unauthenticated access control bypass exists in JoomGallery's category JSON view. When a gallery category is protected with a password, the HTML view correctly enforces the password gate - but the JSON view ( format=json ) skips this check entirely.

Referencias oficiales

www.joomgalleryfriends.nethttps://www.joomgalleryfriends.net/

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-76609—

—

———Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik < 4.7.2 - The onUpdateComment endpoint did not perform any access checks.6h CVE-2026-76608—

—

———Joomla Extension - fabrikar.com - Unauthenticated disclosure of any commenter's email address in Fabrik < 4.7.2 - The onGetEmail endpoint did not perform any access checks.6h CVE-2026-76607—

—

———Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik < 4.7.3 - ???.6h CVE-2026-76603—

—

———Joomla Extension - fabrikar.com - Unauthenticated row disclosure via form.inlineedit in Fabrik < 4.7.3 - The inineedit form controller does not perform any access checks, disclosing items to unauthorized users.6h CVE-2026-76601—

—

———Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik < 4.7.2 - The order plugin did not perform any access checks.6h CVE-2026-76600—

—

———Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik < 4.7.2 - The DeleteComment endpoint did not perform any access checks.6h