Event Gallery CVE-2026-100748

Exploitation requires a victim who is actively authenticated to a Joomla site running the Event Gallery extension (svenbluege.de) at a version below 6.5.0, and who visits attacker-controlled web content while that session is valid. The affected code path is the extension's shopping-cart actions, which lack anti-CSRF token validation. Limiting factors: the attack only succeeds against an already-logged-in user (user interaction / an active session is effectively required despite the vendor's UI:N rating), impact is confined to cart-state manipulation (integrity-low, no data theft or service disruption), and only sites with this specific extension installed are exposed.

This is a high-CVSS-but-modest-real-risk issue. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 6.9, but the metric choices are inconsistent with the CWE-352 (CSRF) nature of the flaw: a CSRF attack inherently requires a logged-in victim to be tricked into submitting a forged request, which is user interaction - so UI:N is generous and the true UI should be Required. The impact is also narrow: VC:N/VI:L/VA:N means confidentiality and availability are untouched and integrity is only low (limited to shopping-cart state changes such as adding/modifying/removing items). There is no EPSS score, no CISA KEV listing, and no public proof-of-concept in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' Combined with a niche affected product (a single Joomla extension), the practical priority is LOW despite the medium-band CVSS number. Note the conflict: the CVSS vector implies a fully unauthenticated, no-interaction attack, but the CSRF class implies an authenticated victim and a click - verify with the vendor.

An attacker hosts a malicious page or emails a crafted link/auto-submitting form to a user who is currently logged into a Joomla site running the Event Gallery extension. When the victim's browser loads the attacker content, it silently issues forged cart-action requests (add/modify/remove items) under the victim's session. No public exploit code is identified in the available data.