JoomGallery (com_joomgallery) 4.0.0 to 4.3.x - Authenticated Access to Password-Protected Content, Ownership Takeover and Stored XSS

Every JoomGallery 4.x release from 4.0.0 up to and including the 4.3.x line carries two security flaws, present since the start of the 4.x branch. Both were reported to the vendor on 3 August 2026 by Toan Le and fixed in 4.4.0. CVE-2026-66916 (unauthorised access to protected content): information about images and categories can be read even when that content is meant to be protected. This mainly affects password-protected galleries, where details may be disclosed and, in some cases, the protected images themselves accessed or downloaded without authorisation. CVE-2026-66917 (ownership manipulation and JavaScript injection): a logged-in user holding edit permissions can reassign ownership of images or categories belonging to other users, which then grants them rights over content they never owned. The same flaw allows JavaScript to be injected through certain front-end views, so the injected code executes in the browser of anyone who later views that content (stored XSS). Exploitation requires a logged-in user with the relevant JoomGallery editing permissions, so the exposure is highest on galleries that let members edit content from the front end. The vendor rates both as medium risk and states that full system compromise is not possible. A gallery managed only by trusted administrators in the back end, with no front-end editing granted to other users, is at significantly lower practical risk. Fix: update to JoomGallery 4.4.0 or later, then review the editable content for anything already tampered with. If you use JoomGallery template overrides, apply the changes from the update to those overrides as well, otherwise an override can reintroduce the vulnerable output. Temporary mitigation until you can update: withdraw front-end JoomGallery edit permissions from all non-administrator user groups via the component ACL. This rule covers the Joomla 4/5/6 branch only. The separate JoomGallery 3.x branch for Joomla 3 is not covered by this advisory.

How CVE-2026-66917 is scored

The base metrics as Joomla CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.

Timeline

1. 22 August 2026CVE-2026-66917 record published by its CNA
2. 22 August 2026mySites.guru check added for JoomGallery (from 4.0.0 up to but not including 4.4.0)

Rule details

Other vulnerabilities in JoomGallery

Updating for CVE-2026-66917 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extension.

References

• CVE-2026-66917 on cve.org (the official CVE record)
• CVE-2026-66917 in the NIST National Vulnerability Database
• joomgalleryfriends.net/en/blog/joomgallery-4-en/joomgallery-4-4-0.html