{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/joomgallery/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-66916"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["JoomGallery (\u003c= 4.3.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["JoomGallery"],"content_html":"\u003cp\u003eJoomGallery versions 4.3.0 and earlier suffer from an improper access control vulnerability (CVE-2026-66916) in the \u003ccode\u003eJsonView.php\u003c/code\u003e component. While the HTML-based view correctly enforces password protection for gallery categories, the JSON interface (\u003ccode\u003eformat=json\u003c/code\u003e) fails to implement the required \u003ccode\u003epw_protected\u003c/code\u003e flag checks. This oversight permits unauthenticated remote attackers to query any public-access category ID and receive a full JSON object containing category titles, descriptions, and randomized file paths for protected images. Because JoomGallery relies on the obscurity of these randomized filenames for its security model, the leakage of filenames allows attackers to download the underlying protected images directly from the web server's static directory. This vulnerability affects JoomGallery installations running on Joomla, as the framework does not propagate access checks across different view formats.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a JoomGallery installation and identifies target category IDs, which are sequential and easily enumerated.\u003c/li\u003e\n\u003cli\u003eAttacker crafts an HTTP GET request to the target component: \u003ccode\u003eindex.php?option=com_joomgallery\u0026amp;view=category\u0026amp;format=json\u0026amp;id=[ID]\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe web server routes the request to \u003ccode\u003esite/com_joomgallery/src/View/Category/JsonView.php\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe application logic executes \u003ccode\u003egetImages()\u003c/code\u003e without verifying if the requested category is password protected.\u003c/li\u003e\n\u003cli\u003eThe application serializes the category's private data, including randomized full filenames, into a JSON response.\u003c/li\u003e\n\u003cli\u003eThe attacker receives the JSON response containing the secret image filenames.\u003c/li\u003e\n\u003cli\u003eThe attacker constructs a direct request to the static file path: \u003ccode\u003e/images/joomgallery/originals/[filename]\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe web server serves the protected image directly, completing the unauthorized access.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the full disclosure of private gallery metadata and the unauthorized download of password-protected images. Since categories are enumerable via ID, an attacker can systematically harvest all content from any password-protected, public-access category. This vulnerability impacts all users of JoomGallery versions 4.3.0 and earlier until upgraded to 4.4.0.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized, concrete actions for detection engineering teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade JoomGallery to version 4.4.0 immediately to address CVE-2026-66916.\u003c/li\u003e\n\u003cli\u003eImplement web server access controls or WAF rules to block access to the \u003ccode\u003e/images/joomgallery/originals/\u003c/code\u003e directory from external requests.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rules below to detect attempts to access the vulnerable JSON view endpoint.\u003c/li\u003e\n\u003cli\u003eAudit existing JoomGallery categories to ensure sensitive images are not stored in directories exposed via direct web requests.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-23T16:57:04Z","date_published":"2026-08-23T16:57:04Z","id":"https://feed.craftedsignal.io/briefs/2026-08-joomgallery-bypass/","summary":"JoomGallery versions 4.3.0 and earlier are vulnerable to an access control bypass via the JSON view component, allowing unauthenticated attackers to retrieve protected image metadata and bypass password gates to download private content.","title":"Unauthenticated Access Control Bypass in JoomGallery","url":"https://feed.craftedsignal.io/briefs/2026-08-joomgallery-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - JoomGallery","version":"https://jsonfeed.org/version/1.1"}