CVE-2026-105605

MediumCVSS 5.3

Published: 02/11/2026(UTC)Updated: 02/11/2026(UTC)Translated: 02/11/2026(UTC)NVD NIST

Summary

The Joomla DJ-Classifieds extension before 3.11.3 contains an IDOR vulnerability in the "duplicate my ad" feature of the new-ad form. An advert is loaded by its raw numeric ID without verifying that it belongs to the requesting user or whether it is published, blocked, or a pending draft, allowing any logged-in user to retrieve the full content of another user's ad, including contact details and price.

Risk Assessment

Any logged-in user can access sellers' personal and contact data as well as unpublished ad content. This breaches privacy and may lead to misuse of contact information.

Recommendation

Update DJ-Classifieds to version 3.11.3 or later. Until then, consider disabling the "duplicate my ad" feature.

Other vulnerabilities in DJ-Classifieds

CVE-2026-61424Critical
The Joomla extension DJ-Classifieds versions below 3.11.2 is vulnerable to unauthenticated arbitrary file upload. An attacker without authentication can upload any file, leading to full remote code execution (RCE).

Original NVD description (English source)

Joomla Extension - dj-extensions.com - IDOR vulnerability allowing cross-account ad access in DJ-Classifieds < 3.11.3 - A “duplicate my ad” convenience feature on the new-ad form (site/models/additem.php) loaded an existing advert by its raw numeric ID with no check that the ad belonged to the requesting user, and no check of whether it was published, blocked, or still a pending draft. Any logged-in user, regardless of role, could request the new-ad form with another ad’s ID and have that ad’s full content, including the seller’s phone number, address, email, and price, rendered into the response, even for ads that had never been published. Advert IDs are small sequential integers.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS