JoomGallery (com_joomgallery) 4.0.0 to 4.3.x - Authenticated Access to Password-Protected Content, Ownership Takeover and Stored XSS

Every JoomGallery 4.x release from 4.0.0 up to and including the 4.3.x line carries two security flaws, present since the start of the 4.x branch. Both were reported to the vendor on 3 August 2026 by Toan Le and fixed in 4.4.0. CVE-2026-66916 (unauthorised access to protected content): information about images and categories can be read even when that content is meant to be protected. This mainly affects password-protected galleries, where details may be disclosed and, in some cases, the protected images themselves accessed or downloaded without authorisation. CVE-2026-66917 (ownership manipulation and JavaScript injection): a logged-in user holding edit permissions can reassign ownership of images or categories belonging to other users, which then grants them rights over content they never owned. The same flaw allows JavaScript to be injected through certain front-end views, so the injected code executes in the browser of anyone who later views that content (stored XSS). Exploitation requires a logged-in user with the relevant JoomGallery editing permissions, so the exposure is highest on galleries that let members edit content from the front end. The vendor rates both as medium risk and states that full system compromise is not possible. A gallery managed only by trusted administrators in the back end, with no front-end editing granted to other users, is at significantly lower practical risk. Fix: update to JoomGallery 4.4.0 or later, then review the editable content for anything already tampered with. If you use JoomGallery template overrides, apply the changes from the update to those overrides as well, otherwise an override can reintroduce the vulnerable output. Temporary mitigation until you can update: withdraw front-end JoomGallery edit permissions from all non-administrator user groups via the component ACL. This rule covers the Joomla 4/5/6 branch only. The separate JoomGallery 3.x branch for Joomla 3 is not covered by this advisory.

Affected versions: ≥ 4.0.0 and < 4.4.0

Official record: cve.org · NVD

Every connected Joomla site is checked against this rule on each audit, and flagged if it runs an affected version.

How CVE-2026-66916 is scored

The base metrics as Joomla CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.

The rule below is rated High for the set of 2 CVEs it covers together, not for this record on its own.

Affected extensions and versions