{"id":"CVE-2026-117544","kind":"vulnerability","aliases":["CVE-2026-117544"],"related":[],"title":"jDownloads Joomla extension: IDOR lets users fetch restricted files","description":"Joomla Extension - jdownloads.com - IDOR allowing restricted file downloads in jDownloads < 4.1.8 - The `other_file_id` parameter could reference another download’s file without fully enforcing the target download’s access restrictions. This allowed files to be delivered to users who were not authorised to access the target download.","summary":"jDownloads, a file download extension for Joomla, fails to enforce the access restrictions of a target download when the other_file_id parameter is used. An attacker can receive files they are not authorised to access.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"jdownloads","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["jdownloads","joomla","php","runtime"],"not_affected_if":["jdownloads-4.1.8-or-later"],"how_to_check":"- Check the installed jDownloads version in the Joomla administrator under Extensions > Manage, and compare it with the fixed version.","fix":"- jDownloads: move to `4.1.8` or later.","status":"open","published_at":"2026-11-12T19:16:47+00:00","first_seen_at":"2026-11-12T19:40:13+00:00","triaged_at":"2026-11-12T19:40:48+00:00","updated_at":"2026-11-12T19:40:48+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-12T19:40:48Z","model":"claude-haiku-5-5","output":{"fix":"- jDownloads: move to `4.1.8` or later.","reach":"internet","title":"jDownloads Joomla extension: IDOR lets users fetch restricted files","impact":"medium","summary":"jDownloads, a file download extension for Joomla, fails to enforce the access restrictions of a target download when the other_file_id parameter is used. An attacker can receive files they are not authorised to access.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["joomla","jdownloads","php"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Restricted files downloaded by unauthorised users","analyst_note":"Confirm whether an account is required and whether restricted downloads are enabled by default, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-117544.","how_to_check":"- Check the installed jDownloads version in the Joomla administrator under Extensions > Manage, and compare it with the fixed version.\n- unknown for other checks; the sources do not say.","plain_action":"","product_name":"jdownloads","needs_analyst":true,"not_affected_if":["jdownloads-4.1.8-or-later"],"who_is_affected":"Joomla sites running the jDownloads extension before 4.1.8 that offer restricted downloads. Sites without jDownloads, or without restricted downloads, are not described as exposed by the sources.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00073,"input_tokens":4568,"output_tokens":547,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-117544':12A,15A '-2026':11A,14A '4.1.8':67C 'access':32B,56B,86C,101C 'allow':61C,89C 'anoth':75C 'attack':47B 'authoris':54B,99C 'could':73C 'cve':10A,13A 'deliv':93C 'download':24B,37B,64C,76C,84C,104C 'enforc':30B,81C 'extens':3A,25B,58C 'fail':28B 'fetch':7A 'file':9A,23B,41B,50B,63C,70C,78C,90C 'fulli':80C 'id':42B,71C 'idor':4A,60C 'jdownload':1A,17B,21B,66C 'jdownloads':16A 'jdownloads.com':59C 'joomla':2A,18B,27B,57C 'let':5A 'paramet':43B,72C 'php':19B 'receiv':49B 'refer':74C 'restrict':8A,33B,62C,87C 'runtim':20B 'target':36B,83C,103C 'use':45B 'user':6A,95C 'without':79C","nicknames":[],"mitigations":[],"who_affected":"Joomla sites running the jDownloads extension before 4.1.8 that offer restricted downloads. Sites without jDownloads, or without restricted downloads, are not described as exposed by the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["jdownloads"],"ptokens":["jdownloads"],"labels":["high","jdownloads","joomla","php","runtime","vendor"],"campaign_type":null,"search_a":"'-117544':12A,15A '-2026':11A,14A 'cve':10A,13A 'extens':3A 'fetch':7A 'file':9A 'idor':4A 'jdownload':1A 'jdownloads':16A 'joomla':2A 'let':5A 'restrict':8A 'user':6A","search_b":"'access':32B,56B 'attack':47B 'authoris':54B 'download':24B,37B 'enforc':30B 'extens':25B 'fail':28B 'file':23B,41B,50B 'id':42B 'jdownload':17B,21B 'joomla':18B,27B 'paramet':43B 'php':19B 'receiv':49B 'restrict':33B 'runtim':20B 'target':36B 'use':45B","search_c":"'4.1.8':67C 'access':86C,101C 'allow':61C,89C 'anoth':75C 'authoris':99C 'could':73C 'deliv':93C 'download':64C,76C,84C,104C 'enforc':81C 'extens':58C 'file':63C,70C,78C,90C 'fulli':80C 'id':71C 'idor':60C 'jdownload':66C 'jdownloads.com':59C 'joomla':57C 'paramet':72C 'refer':74C 'restrict':62C,87C 'target':83C,103C 'user':95C 'without':79C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T19:16:47+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@joomla.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117544","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117544","severity":null,"published_at":"2026-11-12T19:16:47+00:00","modified_at":"2026-11-12T19:16:47+00:00","first_seen_at":"2026-11-12T19:40:13+00:00","fetched_at":"2026-11-12T19:40:13+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}