What is the CVSS score of CVE-2026-58149?

CVE-2026-58149 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Events Booking CVE-2026-58149

EUVD-2026-45200 MEDIUM

Information Exposure (CWE-200)

2026-07-17 Joomla

GHSA-946m-vcxj-cf9w

Information Disclosure Events Booking Extension For Joomla Joomdonation Com

5.3

CVSS 3.1 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible with no auth or interaction required; confidentiality limited to usernames and emails only; no integrity or availability impact applies.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 22:30 vuln.today

CVSS changed

Jul 20, 2026 - 20:22 NVD

5.3 (MEDIUM)

CVE Published

Jul 17, 2026 - 15:45 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The Joomla extension Events Booking is vulnerable to an unauthenticated user enumeration that allows to retrieve account usernames and email addresses.

AnalysisAI

Unauthenticated user enumeration in the Events Booking extension for Joomla (versions 1.0 through 5.8.0) exposes registered account usernames and email addresses to any unauthenticated remote attacker. The flaw requires no credentials, no user interaction, and no special configuration beyond the extension being installed and active - making it trivially accessible to automated tooling. While not confirmed actively exploited (no CISA KEV listing) and carrying a low EPSS probability of 0.15%, the harvested PII enables follow-on phishing, credential stuffing, or account targeting campaigns against Joomla site users.

Technical ContextAI

The affected component is the Events Booking extension for Joomla (CPE: cpe:2.3:a:joomdonation.com:events_booking_extension_for_joomla:*:*:*:*:*:*:*:*), a third-party event registration and ticketing add-on for the Joomla CMS developed by JoomDonation. The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the extension exposes an endpoint or query mechanism that returns user account data - specifically usernames and email addresses - without enforcing authentication or access controls. This is a classic information disclosure pattern where a registration or attendee-lookup feature fails to gate responses to authenticated or privileged sessions, allowing unauthenticated callers to systematically enumerate the user base by probing the API or rendered output.

RemediationAI

Check the vendor's product page at https://joomdonation.com/joomla-extensions/events-booking-joomla-events-registration.html for an updated release of the Events Booking extension, as no specific patched version number was confirmed in available intelligence at time of analysis - see confidence notes. Update to the latest available version of the extension through the Joomla Extension Manager. As a compensating control pending patching, administrators can restrict access to the affected enumeration endpoint via web server rules (Apache mod_rewrite or nginx location blocks) to block unauthenticated external access to user-listing or attendee-search functionality; note this may impact legitimate event registration workflows. Additionally, consider enabling Joomla's built-in access control to restrict front-end user listing features to registered users only. Review event attendee data exposure settings within the extension's configuration panel and disable public attendee listings if not operationally required.