CVE-2026-66916

CVE-2026-66916 exposes a fundamental authorization gap in JoomGallery: password-protected categories enforce access control on the HTML view but bypass it entirely when the same resource is requested through the JSON API. An unauthenticated attacker can enumerate category names, descriptions, image filenames, upload timestamps, and EXIF metadata without ever providing the required password. The 6.9 CVSS score measures technical severity but misses the point — these categories exist precisely because site operators deemed the information sensitive. A category protecting photos from a private corporate event, legal matter, or personal situation now exposes its structural metadata through an unaudited code path that predates the password feature itself. This is not an implementation oversight; it's an architectural failure where authorization was bound to the HTML presentation layer rather than enforced at the resource layer. The JSON endpoint wasn't added after password protection — it sat in code twilight, unaudited against newer security requirements, waiting for misalignment. Every CMS extension that adds password protection to its primary view without auditing existing API endpoints will reproduce this pattern. The 4.4.0 patch closes this specific bypass, but examine the commit before treating it as resolved. If it adds a format-specific guard to the JSON controller without refactoring authorization to a unified layer, the vulnerability will recur in other output formats — XML, RSS, or whatever comes next. The real test is whether JoomGallery now treats each output format as a separate authorization surface requiring explicit review when access controls change, rather than assuming the HTML view's security blanket extends everywhere. If you run JoomGallery: upgrade to 4.4.0 immediately, then audit your non-HTML endpoints for similar gaps. If you develop CMS extensions: treat authorization as a property of the resource, not the view. The moment you build a security check against 'the page' instead of 'the data,' you've created a bypass waiting to happen.

Reviewed through automated stages and approved by a human before publication.