Unauthenticated Access Control Bypass in JoomGallery

JoomGallery versions 4.3.0 and earlier suffer from an improper access control vulnerability (CVE-2026-66916) in the JsonView.php component. While the HTML-based view correctly enforces password protection for gallery categories, the JSON interface (format=json) fails to implement the required pw_protected flag checks. This oversight permits unauthenticated remote attackers to query any public-access category ID and receive a full JSON object containing category titles, descriptions, and randomized file paths for protected images. Because JoomGallery relies on the obscurity of these randomized filenames for its security model, the leakage of filenames allows attackers to download the underlying protected images directly from the web server's static directory. This vulnerability affects JoomGallery installations running on Joomla, as the framework does not propagate access checks across different view formats.

Attack Chain

1. Attacker identifies a JoomGallery installation and identifies target category IDs, which are sequential and easily enumerated.
2. Attacker crafts an HTTP GET request to the target component: index.php?option=com_joomgallery&view=category&format=json&id=[ID].
3. The web server routes the request to site/com_joomgallery/src/View/Category/JsonView.php.
4. The application logic executes getImages() without verifying if the requested category is password protected.
5. The application serializes the category's private data, including randomized full filenames, into a JSON response.
6. The attacker receives the JSON response containing the secret image filenames.
7. The attacker constructs a direct request to the static file path: /images/joomgallery/originals/[filename].
8. The web server serves the protected image directly, completing the unauthorized access.

Impact

Successful exploitation allows for the full disclosure of private gallery metadata and the unauthorized download of password-protected images. Since categories are enumerable via ID, an attacker can systematically harvest all content from any password-protected, public-access category. This vulnerability impacts all users of JoomGallery versions 4.3.0 and earlier until upgraded to 4.4.0.

Recommendation

Prioritized, concrete actions for detection engineering teams:

• Upgrade JoomGallery to version 4.4.0 immediately to address CVE-2026-66916.
• Implement web server access controls or WAF rules to block access to the /images/joomgallery/originals/ directory from external requests.
• Deploy the Sigma rules below to detect attempts to access the vulnerable JSON view endpoint.
• Audit existing JoomGallery categories to ensure sensitive images are not stored in directories exposed via direct web requests.