Executive brief
JoomProject is a project management extension for the Joomla content management system used to track tasks, milestones, and team collaboration. A security flaw allows unauthorized individuals to access sensitive user information, including full names and email addresses, without needing to log in. This exposure could lead to privacy violations, targeted phishing attacks against staff, or the harvesting of corporate contact lists.
Technical details
An information disclosure vulnerability exists in the JoomProject component (com_jpprojects) for Joomla, specifically within the projects view. The root cause is a lack of proper authorization checks on the projects endpoint when requested in JSON format. An unauthenticated remote attacker can exploit this by sending a crafted HTTP request to index.php with specific parameters (option=com_jpprojects&view=projects&tmpl=component&format=json). Successful exploitation allows the attacker to retrieve a JSON payload containing sensitive user details, including user IDs, author names, and email addresses. While the advisory specifically mentions version 1.1.3.2, later versions (such as v5.11.0 and v6.0.1) are available, suggesting users should upgrade to the latest supported release.
Affected products
- Joomboost JoomProject 1.1.3.2 and earlier
Timeline
- 2019-01-11: disclosed: Initial exploit code published on Exploit-DB
- 2026-06-19: advisory: NVD and VulnCheck published formal advisory details