IDOR + Stored XSS via Broken Object-Level Authorization in JoomGallery

JoomGallery ≤ 4.3.0 — Editor-Role User Hijacks Any Gallery Image and Stores XSS Payload, Enabling Admin Session Takeover

SUMMARY

UserimageController::save() in JoomGallery checks checkACL('edit', ...) instead of checkACL('edit.own', ...). An Editor-role user can POST to task=userimage.save&id=N for any image regardless of ownership (IDOR — CWE-639). Because Editor-role carries core.edit globally, the authorization check passes for every image ID on the site, including images owned by administrators.

Combined with a missing $this->escape() call in the frontend image template, an Editor can store an XSS payload in any image title — including admin-owned images — causing JavaScript execution in every visitor's browser. This enables full admin session hijack and site-wide compromise.

AFFECTED VERSIONS

VULNERABILITY DETAILS

Type: Broken Object-Level Authorization / IDOR (CWE-639) chained with Stored Cross-Site Scripting (CWE-79) Authentication required: Low-privilege Editor account

Root Cause 1 — IDOR (CWE-639)

File: components/com_joomgallery/src/Controller/UserimageController.php

The save() action performs an ACL check using edit permission instead of edit.own. The edit permission is granted to all Editor-role users globally, so the check succeeds for any image ID regardless of who created it.

USERIMAGECONTROLLER.PHP — VULNERABLE CODE (LINE 145)

// Vulnerable
if (!$this->checkACL('edit', 'image', $recordId, $parent_id, true)) { ... }

Because core.edit is held globally by the Editor group, the condition evaluates to false for every image ID, granting unrestricted write access. On a successful save, the model additionally updates created_by to the attacker's user ID, silently transferring ownership of the image to the attacker.

Root Cause 2 — Stored XSS (CWE-79)

File: components/com_joomgallery/tmpl/image/default.php

The frontend image template echoes $this->item->title without HTML-encoding it into the alt attribute context. Joomla's JInput STRING filter does not strip double-quote characters, so a payload containing " breaks out of the attribute and injects arbitrary event handlers.

DEFAULT.PHP — VULNERABLE CODE (LINES 64, 78)

// Vulnerable
item->title; ?>" ...>

The payload abc" onmouseover="alert(document.domain);" x=" is stored in jos_joomgallery.title and injected raw into the HTML attribute on every page render. No sanitization occurs at the storage or display layer.

PROOF OF CONCEPT

Attack Chain Overview

1. Admin creates a gallery image (ID=3). Owner = Administrator. Published and Approved.
2. Attacker logs in as Editor. Extracts session cookie and CSRF token from the login page.
3. Attacker fetches a fresh CSRF token from the JoomGallery component.
4. IDOR: Editor POSTs task=userimage.save&id=3 with XSS payload in jform[title]. ACL check passes (core.edit, not edit.own). Server returns HTTP 303 — not 403.
5. Title updated with unescaped payload. created_by transferred to attacker's user ID.
6. XSS payload stored unescaped in jos_joomgallery.title.
7. Any visitor (or admin) browses the gallery frontend. Template renders alt="abc" onmouseover="alert(document.domain);". XSS fires. Admin session captured → full site compromise.

1. Admin Creates Gallery Image — Owner: Administrator, ID = 3

Admin creates admin_image via JoomGallery backend (Joomla 5.4.7). Image is Published, Approved, and owned by Administrator

2. Editor Extracts CSRF Token from Login Page

GET /index.php/component/users/login — response JSON contains "csrf.token":"a68c2b3a...". Token captured for the subsequent login POST.

3. Editor Logs In — HTTP 303, joomla_user_state=logged_in

POST /index.php/component/users/login with CSRF token and Editor credentials. Response: HTTP 303 and Set-Cookie: joomla_user_state=logged_in. Session cookie captured.

4. Editor Extracts Fresh JoomGallery CSRF Token

GET /index.php?option=com_joomgallery with session cookie. Response contains a new "csrf.token":"2d96934b..." for use in the save request.

5. IDOR + XSS Injection — Server Accepts with HTTP 303

Editor POSTs to option=com_joomgallery&task=userimage.save&id=3 with jform[title] set to:

abc" onmouseover="alert(document.domain);" x="

Server returns HTTP 303 (not 403), confirming the IDOR. Location header shows the XSS payload in the redirect URL, confirming the title was accepted and saved.

6. Ownership Transferred — Owner Changed to Editor User

JoomGallery backend shows image ID=3 now has Owner: Editor User. The created_by field was silently updated in the database during the unauthorized save.

7. Database Confirms Payload Stored Unescaped

SQL query on jos_joomgallery confirms the XSS payload is stored — " is stored as a raw double-quote, not as ". No sanitization occurred at the storage layer.

8. XSS Fires on Gallery Frontend

Any user visiting /index.php/component/joomgallery/gallery triggers the payload. The browser's alert() dialog confirms JavaScript execution in the victim's origin (document.domain).

IMPACT

1. Unauthorized Image Modification (IDOR): An Editor-role user can modify any gallery image on the site, including images owned by administrators, without ownership validation.
2. Silent Ownership Transfer: Every unauthorized save silently reassigns created_by to the attacker, permanently altering the audit trail.
3. Stored XSS — Persistent Execution: The injected JavaScript payload executes in every visitor's browser on each gallery page load, affecting unauthenticated visitors and administrators alike.
4. Admin Session Hijack → Full Site Compromise: A malicious script in the alt attribute can exfiltrate the administrator's session cookie, granting the attacker full backend access and control over the entire Joomla installation.
5. Scope Change: The XSS executes in the victim's browser origin (CVSS S:C), crossing the trust boundary between the attacker's low-privilege session and the victim's high-privilege session.

REFERENCES

• CVE: https://www.cve.org/CVERecord?id=CVE-2026-66917
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-66917
• GitHub Advisory: https://github.com/advisories/GHSA-8vxv-gf52-gm5h
• Vendor Repository: https://github.com/JoomGalleryfriends/JoomGallery
• Vendor New Release Note: https://www.joomgalleryfriends.net/en/blog/joomgallery-4-en/joomgallery-4-4-0.html