Event Gallery CVE-2026-102777

Exploitation requires the Event Gallery for Joomla extension (< 6.6.0) with the Google Photos picker on the back-end upload page in use and an authenticated Google Photos OAuth session active (the leaked token is valid for ~1 hour and inherits the picker session's scope). The browser-driven path additionally requires a currently logged-in back-end administrator to be tricked into visiting an attacker-controlled page, since the vulnerable fetch task performs no form-token/CSRF validation and accepts an unchecked destination address. Alternatively, a back-end user already granted the 'Manage' permission can invoke the request directly without any user-interaction or CSRF step. Limiting factors: the Google Photos integration must be configured and in an active session, and the remote path depends on social-engineering an interacting admin - reducing realistic blast radius versus the network attack vector alone.

This is a moderate, targeted-risk SSRF/CSRF issue rather than a mass-exploitation priority. The source CVSS 4.0 score is 6.3 (Medium) with AV:N/AC:L but UI:A, meaning network reachability is offset by a required active-interaction step: the back-end flaw has no form-token (CSRF) protection, so a logged-in Joomla administrator must be lured to visit a prepared external page for the browser-driven path, OR a back-end user already holding the 'Manage' permission can trigger it directly. PR:N is technically correct because the remote path rides an existing admin session rather than attacker credentials, but it overstates ease of exploitation - the attacker still needs a victim admin with an active Google Photos picker/OAuth session or an insider with Manage rights. The SC:H / SI:L / SA:L subsequent-system metrics correctly capture that the leaked OAuth access token reaches whatever the picker session reaches (the victim's Google Photos account) and that internal network addresses can be probed. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence, so there is no signal of active or probable exploitation; the condition dependency (OAuth-configured picker + admin interaction or Manage insider) plus the niche extension footprint makes widespread opportunistic attacks unlikely. Note the conflicting ease signal: CVSS marks PR:N but the real-world prerequisite is an authenticated/interacting administrator - treat it as CSRF-gated rather than freely unauthenticated.

An attacker hosts a prepared web page and lures a Joomla administrator who is logged into the Event Gallery back end (with an active Google Photos OAuth picker session) to visit it. Because the thumbnail-fetch task accepts an attacker-supplied address and requires no form token, the page forces the server to fetch an attacker-controlled URL - sending the Google Photos access token to the attacker - or to fetch internal-network addresses on the admin's behalf. No public exploit is identified at time of analysis; a back-end user with the 'Manage' permission could perform the same request directly without the CSRF step.