Read the docs
TI-2026-83931 Aliases CVE-2026-105605GHSA-pmm5-h3g5-rm6q

Access control flaw in DJ-Classifieds exposes other users' ads

Priority LOW 24CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

The DJ-Classifieds extension for Joomla before 3.11.3 has an insecure direct object reference (CWE-639). The duplicate ad feature on the new-ad form loads an ad by its numeric ID without checking ownership or publication status. Any logged-in user can view another user's ad content, including the seller's phone number, address, email and price, even for unpublished drafts.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

Joomla Extension - dj-extensions.com - IDOR vulnerability allowing cross-account ad access in DJ-Classifieds < 3.11.3 - A “duplicate my ad” convenience feature on the new-ad form (site/models/additem.php) loaded an existing advert by its raw numeric ID with no check that the ad belonged to the requesting user, and no check of whether it was published, blocked, or still a pending draft. Any logged-in user, regardless of role, could request the new-ad form with another ad’s ID and have that ad’s full content, including the seller’s phone number, address, email, and price, rendered into the response, even for ads that had never been published. Advert IDs are small sequential integers.

Why it matters now

EPSS 0.00294 22nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
dj-extensions.comDJ-Classifieds extension for Joomla1.0-3.11.2—No fix listedCNA
  • DJ-Classifieds extension for Joomla Vendordj-extensions.com Affected 1.0-3.11.2 Fixed in — No fix listed CNA

Remediation

No fixed version is listed for the DJ-Classifieds extension for Joomla.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Timeline

  1. 2026-11-02 Threatist record created from CVE-2026-105605
  2. 2026-11-02 Alias added: GHSA-pmm5-h3g5-rm6q

References

Other 1

  • TI-2026-44289 Unrestricted file upload in dj-extensions.com jDownloads extension for Joomla CVSS 4.0CRITICAL 10.0
  • TI-2026-44029 Unrestricted file upload in dj-extensions.com DJ-Classifieds extension for Joomla CVSS 4.0CRITICAL 10.0
  • TI-2026-83930 Unauthenticated SQL injection in DJ-Classifieds Joomla extension CVSS 4.0CRITICAL 9.3
  • TI-2026-81122 Stored cross-site scripting in DJ-HelpfulArticles Joomla extension CVSS 4.0HIGH 8.7
  • TI-2025-32030 Extension - dj-extensions.com - SQLi vulnerability in DJ-Flyer component 1.0-3.2 for Joomla CVSS 4.0HIGH 8.5
  • TI-2026-83929 Arbitrary file upload in Joomla extension DJ-Classifieds CVSS 4.0CRITICAL 9.4
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences