Executive brief
JoomGallery is a Joomla extension providing image gallery functionality. An unauthenticated attacker can bypass password protection on gallery categories by requesting the JSON format view instead of the standard HTML view, gaining unauthorized access to restricted images without knowing the password.
Technical details
This is an access control bypass vulnerability in JoomGallery's category view handler. When a gallery category is protected with a password, the HTML view correctly enforces the password gate. However, the JSON API endpoint (format=json parameter) fails to perform the same authorization check, allowing unauthenticated requests to retrieve protected category data in JSON format. The vulnerability is network-reachable without authentication or user interaction. An attacker can exploit this by appending format=json to category URLs to bypass the password protection entirely and access restricted image metadata and content. The vulnerability was patched in JoomGallery 4.4.0 (released 22 August 2026) and earlier patch releases.
Affected products
- JoomGallery JoomGallery < 4.4.0
Timeline
- 2026-08-22: disclosed: CVE-2026-66916 published; JoomGallery 4.4.0 released with patch
- 2026-08-22: patched: JoomGallery 4.4.0 Feature/Safety Release