Balbooa Forms CVE-2026-101112

Exploitation requires only a publicly reachable page using Balbooa Forms below version 2.4.3.4 with the file-attachment upload feature in use, so that temporary attachments exist to target. No authentication and no user interaction are needed: any guest can request a valid Joomla session token for their own session, satisfying the CSRF token check, and then invoke the public removeTmpAttachment action with an arbitrary integer attachment ID. The only real limiter is that impact is confined to deletion of other users' temporary/pending upload records and files (attacker must enumerate valid integer IDs); it does not grant read access or affect fully-committed submissions beyond their temporary attachment state.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a genuinely remote, unauthenticated, low-complexity flaw requiring no user interaction, which is the worst case for reachability. However, the impact is deliberately narrow: only VI:L (integrity-low) is set, with confidentiality and availability at N, because the flaw only lets an attacker delete other users' temporary form attachments - it does not read data or take down the service. The 6.9 score therefore reflects easy reach against limited impact, not a system-compromise bug. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or automated exploitation - this is 'no public exploit identified at time of analysis.' The CVSS and description are consistent (both point to unauthenticated network access), so there is no vector/description conflict to flag. Realistically this is a medium-priority data-integrity issue: trivial to trigger but bounded to nuisance-level destruction of transient upload state, not a high-urgency emergency. The classic CWE-639 (IDOR) pattern is confirmed by the description: authentication of the request (via token) succeeds while authorization of the target object is absent.

An unauthenticated visitor loads a public Balbooa Forms page, obtains a valid Joomla session token for their own session, then calls the public removeTmpAttachment action while iterating integer attachment IDs. Because the model never binds the ID to the uploading session, user, form, or field, each request deletes another visitor's pending attachment row and file. No public exploit code is identified, but the attack is a trivial scripted ID-enumeration loop.