{"id":"CVE-2026-117550","kind":"vulnerability","aliases":["CVE-2026-117550"],"related":[],"title":"jDownloads Joomla extension: frontend submissions bypass publication approval","description":"Joomla Extension - jdownloads.com - Publishing of files without approval in jDownloads < 4.1.8 -  Manipulated frontend submission parameters could bypass the intended publication and ownership rules. In particular, submissions could be published despite automatic publication being disabled, and ownership could be assigned contrary to the intended policy.","summary":"jDownloads, a download manager extension for Joomla, lets manipulated frontend submission parameters skip the intended publication and ownership rules. Files can be published even when automatic publication is disabled, and ownership can be assigned against policy.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["jdownloads","joomla","package","self-hosted"],"not_affected_if":["frontend-submissions-disabled","version-4.1.8-or-later"],"how_to_check":"- Check the installed jDownloads version in the Joomla extensions manager; versions below `4.1.8` are listed as affected.\n- Review whether frontend file submissions are enabled and whether unapproved files appear publicly.","fix":"- jDownloads: move to `4.1.8` or later (fixed version per the sources).","status":"open","published_at":"2026-11-12T18:17:15+00:00","first_seen_at":"2026-11-12T18:40:37+00:00","triaged_at":"2026-11-12T18:42:48+00:00","updated_at":"2026-11-12T18:42:48+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-12T18:42:48Z","model":"claude-haiku-5-5","output":{"fix":"- jDownloads: move to `4.1.8` or later (fixed version per the sources).","reach":"internet","title":"jDownloads Joomla extension: frontend submissions bypass publication approval","impact":"low","summary":"jDownloads, a download manager extension for Joomla, lets manipulated frontend submission parameters skip the intended publication and ownership rules. Files can be published even when automatic publication is disabled, and ownership can be assigned against policy.","audience":"businesses","category":"package","nicknames":[],"who_cares":["joomla","jdownloads","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Unapproved files published and ownership misassigned on the site","analyst_note":"Sources do not describe how a submitter gets an account or the full exploit path; confirm the affected version range beyond the stated fix.","how_to_check":"- Check the installed jDownloads version in the Joomla extensions manager; versions below `4.1.8` are listed as affected.\n- Review whether frontend file submissions are enabled and whether unapproved files appear publicly.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-4.1.8-or-later","frontend-submissions-disabled"],"who_is_affected":"Sites running the jDownloads extension for Joomla below 4.1.8 that accept frontend file submissions from users. Sites without frontend submissions or with the extension already at 4.1.8 or later are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000733,"input_tokens":4572,"output_tokens":551,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-117550':11A,14A '-2026':10A,13A '4.1.8':67C 'approv':8A,64C 'assign':54B,95C 'automat':46B,87C 'bypass':6A,73C 'contrari':96C 'could':72C,83C,93C 'cve':9A,12A 'despit':86C 'disabl':49B,90C 'download':23B 'even':44B 'extens':3A,25B,58C 'file':40B,62C 'frontend':4A,30B,69C 'host':20B 'intend':35B,75C,99C 'jdownload':1A,15B,21B,66C 'jdownloads.com':59C 'joomla':2A,16B,27B,57C 'let':28B 'manag':24B 'manipul':29B,68C 'ownership':38B,51B,78C,92C 'packag':17B 'paramet':32B,71C 'particular':81C 'polici':56B,100C 'public':7A,36B,47B,76C,88C 'publish':43B,60C,85C 'rule':39B,79C 'self':19B 'self-host':18B 'skip':33B 'submiss':5A,31B,70C,82C 'without':63C","nicknames":[],"mitigations":[],"who_affected":"Sites running the jDownloads extension for Joomla below 4.1.8 that accept frontend file submissions from users. Sites without frontend submissions or with the extension already at 4.1.8 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","jdownloads","joomla","package","selfhosted"],"campaign_type":null,"search_a":"'-117550':11A,14A '-2026':10A,13A 'approv':8A 'bypass':6A 'cve':9A,12A 'extens':3A 'frontend':4A 'jdownload':1A 'joomla':2A 'public':7A 'submiss':5A","search_b":"'assign':54B 'automat':46B 'disabl':49B 'download':23B 'even':44B 'extens':25B 'file':40B 'frontend':30B 'host':20B 'intend':35B 'jdownload':15B,21B 'joomla':16B,27B 'let':28B 'manag':24B 'manipul':29B 'ownership':38B,51B 'packag':17B 'paramet':32B 'polici':56B 'public':36B,47B 'publish':43B 'rule':39B 'self':19B 'self-host':18B 'skip':33B 'submiss':31B","search_c":"'4.1.8':67C 'approv':64C 'assign':95C 'automat':87C 'bypass':73C 'contrari':96C 'could':72C,83C,93C 'despit':86C 'disabl':90C 'extens':58C 'file':62C 'frontend':69C 'intend':75C,99C 'jdownload':66C 'jdownloads.com':59C 'joomla':57C 'manipul':68C 'ownership':78C,92C 'paramet':71C 'particular':81C 'polici':100C 'public':76C,88C 'publish':60C,85C 'rule':79C 'submiss':70C,82C 'without':63C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T18:17:15+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@joomla.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117550","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117550","severity":null,"published_at":"2026-11-12T18:17:15+00:00","modified_at":"2026-11-12T18:17:15+00:00","first_seen_at":"2026-11-12T18:40:37+00:00","fetched_at":"2026-11-12T18:40:37+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}