Event Gallery CVE-2026-100749

Requires a Joomla administrator/backend user with access to the Event Gallery extension to be authenticated (active session) and to be tricked into visiting an attacker-controlled page while the backend cleanup actions lack CSRF protection (extension version < 6.5.0). Exploitation is limited by: the need for a high-privilege backend victim (PR:H), the CSRF-inherent requirement that the victim's browser issue the request during a valid session, and the fact that only orphaned/unreferenced file entries and shopping carts older than 30 days are deletable - live data cannot be affected.

This is a genuinely low-priority issue despite a mid-range 5.1 CVSS 4.0 score. The vendor vector (CVSS:4.0/AV:N/AC:L/PR:H/UI:N/VC:N/VI:L/VA:N) shows the only impact is a partial integrity effect (VI:L) with no confidentiality (VC:N) or availability (VA:N) impact, and it requires high privileges (PR:H) - a logged-in backend/administrative Joomla user. The description explicitly bounds the damage: only orphaned file entries and shopping carts older than 30 days can be deleted, so even successful exploitation cannot destroy live/referenced data. No EPSS score, no CISA KEV listing, and no public POC were provided, so this is not a signal of imminent exploitation. Note a conflict worth verifying: this is a CSRF (CWE-352) flaw, which by definition rides on a victim's browser session and normally implies user interaction, yet the vendor vector sets UI:N - CSRF realistically requires the authenticated victim to visit an attacker-controlled page, so real-world exploitation is more constrained than UI:N suggests. Overall: low real-world risk, driven by high-privilege prerequisite, trivial/bounded impact, and no exploitation signals.

An attacker lures a currently-logged-in Event Gallery backend administrator to a malicious web page that auto-submits a forged request to the extension's cleanup action. The request executes under the victim's session and triggers deletion of orphaned file entries and shopping carts older than 30 days. No public exploit code was identified, and the impact is limited to purging already-stale/unreferenced records.