The vulnerability identified as CVE-2026-75951 (CWE-639) affects the J-BusinessDirectory extension for Joomla versions 1.0.0 up to 6.2.2. It is an authorization bypass issue caused by insecure direct object references in multiple frontend and API actions. This flaw allows attackers to bypass authorization controls by manipulating user-controlled keys, potentially accessing or modifying data without proper permissions. The CVSS 4.0 base score is 6.9, indicating a medium severity level. No official patch or remediation guidance has been published yet, and no known exploits are reported in the wild.

Successful exploitation could allow an unauthenticated attacker to bypass authorization controls and access or manipulate data or functionality that should be restricted. This could lead to unauthorized data disclosure or modification within the affected Joomla extension. However, the vulnerability does not require user interaction or privileges, increasing its risk profile.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No temporary or official fixes are currently documented.