An unauthenticated access control bypass exists in the JSON view of the JoomGallery extension for Joomla. When a gallery category is protected by a password, the HTML rendering correctly enforces the gate but the JSON representation – accessed by appending ?format=json> to the URL – skips this check entirely. The flaw is a classic missing authorization check (CWE‑284) that allows anyone to retrieve the contents of a protected category via the JSON endpoint, exposing data that should remain confidential.

The vulnerability affects the JoomGallery extension from joomgalleryfriends.net for Joomla. Any installation using JoomGallery versions earlier than 4.4.0 is susceptible, as the defect was present in all pre‑4.4.0 releases.

The CVSS score of 6.9 indicates moderate severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no known large‑scale exploitation yet. Attackers can trigger the flaw by sending a simple HTTP GET request to the JSON endpoint of a protected category; no authentication or special privileges are required, and the attack is performed over the network from any source. The primary impact is loss of confidentiality through exposure of protected content.