What is the CVSS score of CVE-2026-63047?

CVE-2026-63047 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Events Booking are affected by CVE-2026-63047?

The Events Booking extension for Joomla (versions 5.0-5.8.1) allows unauthenticated attackers to download invoice data belonging to other customers due to an authorization bypass flaw.

How to fix or mitigate CVE-2026-63047?

Within 24 hours, inventory all Joomla installations using the Events Booking extension and identify which are running versions 5.0-5.8.1; pull server access logs to check for suspicious invoice access patterns and prepare customer breach notification if evidence of access is found. Within 7 days, implement interim mitigations by disabling the Events Booking extension if operationally feasible, configuring web server or WAF rules to restrict invoice download endpoints to authenticated users only, or using IP-based access controls to limit invoice functionality exposure; simultaneously notify customers of potential exposure per applicable data breach notification laws. Within 30 days, prepare for rapid patch deployment once the vendor releases a fix, complete a forensic analysis of invoice access logs covering the entire exposure period, and revise Joomla extension vetting criteria to avoid similar authorization bypasses in future procurement decisions.

Events Booking CVE-2026-63047

EUVD-2026-47617 HIGH

Improper Access Control (CWE-284)

2026-07-22 Joomla

GHSA-7hfj-8497-9m6v

Authentication Bypass Events Booking Extension For Joomla Joomdonation Com

7.5

CVSS 3.1 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network access to an invoice endpoint with no ownership check (PR:N/AC:L), disclosing sensitive invoice data (C:H) with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 15:00 vuln.today

CVE Published

Jul 22, 2026 - 07:05 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 22, 2026 - 07:05 cve.org

HIGH 7.5

DescriptionCVE.org

The Joomla extension Events Booking prior version 5.0-5.8.1 did not properly verify that an actor is allowed to download invoice information.

AnalysisAI

Unauthorized invoice disclosure in the Events Booking extension for Joomla (versions 5.0 through 5.8.1) lets remote unauthenticated attackers download invoice data belonging to other users because the extension fails to verify the requester's authorization. Rated CVSS 7.5 (confidentiality-only impact), with no public exploit identified at time of analysis and CISA SSVC marking exploitation status as none. The flaw is an access-control gap (CWE-284) tagged as an authentication/authorization bypass.

Technical ContextAI

Events Booking (JoomDonation) is a commercial events registration and payment extension for the Joomla CMS, handling attendee registrations, ticketing, and generated invoices/receipts. The root cause is CWE-284 (Improper Access Control): an invoice-download endpoint or controller action serves invoice records without confirming the requesting actor owns or is entitled to the record, most likely relying on a guessable/enumerable invoice or registration identifier rather than a server-side ownership check. The single CPE, cpe:2.3:a:joomdonation.com:events_booking_extension_for_joomla:*, identifies the affected component as the Joomla extension itself rather than the Joomla core, so exposure is limited to sites that have this specific extension installed.

RemediationAI

Upgrade the Events Booking extension to a fixed release newer than 5.8.1 as provided by JoomDonation; because the input data does not name an exact patched version, no vendor-released patch version is independently confirmed at time of analysis, so obtain and verify the fixed build directly from the vendor at https://joomdonation.com/joomla-extensions/events-booking-joomla-events-registration.html before deploying. As a compensating control until patched, restrict access to the invoice-download endpoint at the web-server or Joomla ACL layer (for example, block or require authentication on the Events Booking invoice/receipt controller route), which prevents anonymous retrieval but may break legitimate guest-invoice downloads and email receipt links; alternatively place the site behind a WAF rule that blocks direct requests to the invoice-download action from unauthenticated sessions, accepting possible false positives on legitimate registrant traffic. Consult the VulDB advisory (https://vuldb.com/vuln/382274) for tracking.