CVE-2026-75950 is an unauthenticated ownership override in J-BusinessDirectory (Joomla) versions prior to 6.2.3. The endpoint accepted attacker-supplied company_id and user_id parameters, allowing complete takeover of any business listing without credentials. The fix — binding ownership claims to the authenticated session and restricting to unowned listings — is technically trivial, which is the most revealing aspect: this wasn't an architectural complexity failure but a missing security boundary at the point where business logic became authorization logic.
The EPSS score suggests low immediate exploitation probability, but treat this with skepticism. Business directory extensions are high-value targets for SEO spam, credibility laundering, and phishing infrastructure — the CVSS 6.9 captures the technical takeover but not the blast radius. Ownership in J-BusinessDirectory can grant verified-status indicators, API tokens for data feeds, and integration access (Google Business, CRM hooks, map services) that transform a hijacked listing from unauthorized content into a trust-amplification vector. The downstream integration chain likely extends beyond the extension's own codebase, meaning the endpoint-level fix may not propagate authorization constraints to every system reading ownership status.
Check your installation immediately: verify you are on 6.2.3 or later, confirm the ownership assignment endpoint enforces session binding, and audit whether your directory has third-party integrations that inherit ownership privileges. Also assess account registration — if creating throwaway accounts is trivial, the vulnerability may have shifted to an authenticated enumeration attack where attackers pre-register accounts then sequentially claim unowned listings. The fix addresses this specific vector; it does not redesign the authorization model. Expect follow-on CVEs within 12-18 months if the underlying pattern persists.