The J-BusinessDirectory extension for Joomla with versions prior to 6.2.3 contains a flaw that permits an unauthenticated attacker to assign any company and user identifiers to a business listing, effectively transferring ownership. This can be performed even on listings that already have an owner, allowing the attacker to hoist existing listings into their control. As a result, authorized users lose control of their listings, which can be used to spread misinformation, steal reputational value, or conduct fraudulent activity. The weakness corresponds to improper access control (CWE-284) and unauthorized modification of resources (CWE-639).

The affected system is the J-BusinessDirectory extension for Joomla created by cmsjunkie.com. All releases before version 6.2.3 are vulnerable. Users employing these earlier releases should verify and upgrade accordingly.

The vulnerability carries a CVSS score of 6.9, indicating moderate severity. While the EPSS score is not available, the lack of official exploitation data suggests that it has not yet been publicly leveraged. The vulnerability is listed as not part of CISA KEV. The likely attack vector is remote web-based, with an attacker able to send HTTP requests to the vulnerable endpoint without authentication. As the issue allows control over any listing, the potential impact escalates from information disclosure to ownership takeover, with significant loss of integrity and availability for affected businesses.