EUVD-2026-58805
GHSA-p6wp-p37f-5vjh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High privilege required as a backend operator account is mandatory; only limited confidentiality impact from user profile enumeration with no integrity or availability effect.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
Joomla Extension - icagenda.com - ACL bypass allowing arbitrary user enumeration < 2.0.0-4.0.11 - A backend operator granted access scoped to com_icagenda only could enumerate Joomla user profiles.
AnalysisAI
Access control bypass in the iCagenda Event Scheduler Extension for Joomla (all versions prior to 4.0.11) permits authenticated backend operators to enumerate Joomla user profiles beyond their intended permission scope. An operator account granted access exclusively to the com_icagenda component - a tightly restricted, low-trust role - can leverage the flaw to query the broader Joomla user database, violating the principle of least privilege. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid, authenticated Joomla backend operator account with at minimum `com_icagenda` component access granted - this is a high-privilege authenticated condition (PR:H per CVSS). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N scoring 5.1 Medium is internally consistent with the described exploitation conditions: network-exploitable, no attack complexity, no scope change, high privilege required, and only limited confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who holds or obtains a Joomla backend operator account - even one explicitly scoped only to the iCagenda component with no other granted permissions - authenticates to the Joomla admin panel and navigates iCagenda's backend interface to trigger user enumeration requests. By exploiting the ACL bypass, the operator retrieves Joomla user profile data (such as usernames and email addresses) that should be inaccessible to their role. … |
| Remediation | Upgrade the iCagenda Extension to version 4.0.11 or later, which is the vendor-identified fix release; consult the vendor advisory and download page at https://www.icagenda.com/ for the update package. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary PHP file upload in the iCagenda extension for Joomla enables remote unauthenticated attackers to abuse the eve
Stored cross-site scripting in iCagenda Joomla extension versions 4.0.8 through 4.0.12 allows an authenticated event sub
Cross-site request forgery in the iCagenda Joomla extension (versions prior to 4.0.11) exposes multiple frontend state-c
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today