CVE-2026-66916
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery < 4.4.0- An unauthenticated access control bypass exists in JoomGallery's category JSON view. When a gallery category is protected with a password, the HTML view correctly enforces the password gate - but the JSON view ( format=json ) skips this check entirely.
Risk Assessment
The risk includes unauthorized access to protected gallery content, potentially leading to disclosure of sensitive data.
Recommendation
Update JoomGallery to version 4.4.0 or later and enforce access controls for the JSON view as well.
Other vulnerabilities in JoomGallery
See all- CVE-2026-84048Medium
Joomla Extension - joomgalleryfriends.net - Unauthenticated arbitrary file upload via the TUS endpoint in JoomGallery < 4.4.2 - The TUS endpoint allows arbitrary file uploads, however neither file name nor file extension are under attacker control. Code execution requires non-standard server configuration.
- CVE-2026-66917High
Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery < 4.4.0 - An authenticated, privileged can store an XSS payload in any image causing JS execution in every visitor's browser.
Original NVD description (English source)
Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery < 4.4.0- An unauthenticated access control bypass exists in JoomGallery's category JSON view. When a gallery category is protected with a password, the HTML view correctly enforces the password gate - but the JSON view ( format=json ) skips this check entirely.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS