---
id: "CVE-2026-117544"
page: "https://infrastack.ai/live/CVE-2026-117544"
kind: "vulnerability"
aliases: ["CVE-2026-117544"]
title: "jDownloads Joomla extension: IDOR lets users fetch restricted files"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "jdownloads", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["jdownloads", "joomla", "php", "runtime"]
not_affected_if: ["jdownloads-4.1.8-or-later"]
published_at: "2026-11-12T19:16:47+00:00"
first_seen_at: "2026-11-12T19:40:13+00:00"
updated_at: "2026-11-12T19:40:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117544", "first_seen_at": "2026-11-12T19:40:13+00:00"}]
exploit_sources: []
---

# jDownloads Joomla extension: IDOR lets users fetch restricted files

Link for people: https://infrastack.ai/live/CVE-2026-117544 (this .md is for agents)

jDownloads, a file download extension for Joomla, fails to enforce the access restrictions of a target download when the other_file_id parameter is used. An attacker can receive files they are not authorised to access.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:jdownloads affected range not listed fixed no fixed version listed

## How to check

- Check the installed jDownloads version in the Joomla administrator under Extensions > Manage, and compare it with the fixed version.

## Fix

- jDownloads: move to `4.1.8` or later.

## Timeline

- 2026-11-12T19:40:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117544

## From the sources

Joomla Extension - jdownloads.com - IDOR allowing restricted file downloads in jDownloads < 4.1.8 - The `other_file_id` parameter could reference another download’s file without fully enforcing the target download’s access restrictions. This allowed files to be delivered to users who were not authorised to access the target download.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_