IDOR Vulnerability in DJ-Classifieds by Joomla Extension

CVE-2026-105605

What is CVE-2026-105605?

An Insecure Direct Object Reference (IDOR) vulnerability exists within the DJ-Classifieds extension for Joomla, specifically in versions prior to 3.11.3. This vulnerability arises from a feature that allows users to duplicate ads without proper validation. It enables any logged-in user to access the content of any ad by simply supplying its numeric ID, bypassing checks for ownership, publication status, or draft status. As a result, sensitive information such as the seller's contact details can be exposed, even for unpublished ads, posing a significant threat to user privacy and trust.

References