Zoo Extension CVE-2026-77028

Exploitation requires that the target Joomla installation has the yootheme.com Zoo extension installed and active at a version below 4.1.66, and that the form submission functionality exposing the redirect parameter is publicly accessible. A victim user must be socially engineered into following a crafted link - exploitation cannot be triggered server-side without user interaction (UI:P per CVSS vector). No authentication is required by the attacker to craft or distribute the malicious link. What limits exploitation: mandatory user click, impact scoped to the victim's browser session only (no server-side access), and the requirement that the specific Zoo extension be installed and its form endpoint be reachable.

The CVSS 4.0 score of 5.3 (Medium) accurately reflects the constrained real-world impact: the network attack vector and zero privilege requirement lower the bar for crafting malicious links, but the mandatory user interaction (UI:P) prevents fully automated exploitation and substantially reduces mass-scale risk. The confidentiality, integrity, and availability impacts are all rated Low, consistent with client-side XSS scope - session hijacking or credential phishing is possible, but server-side compromise is not. No EPSS data was provided, and neither KEV listing nor public POC is present in the available intelligence, suggesting this is not under active exploitation at the time of analysis. Even a mid-sized municipal IT team in zabrze managing a Joomla-based public portal should treat this as a prompt but not emergency patch, prioritizing the upgrade during the next maintenance window rather than invoking emergency change procedures. The open redirect component adds phishing risk that may be disproportionate to the CVSS score in environments where the site is trusted by users.

An attacker crafts a URL pointing to the vulnerable Joomla site's Zoo extension form submission endpoint, appending a malicious JavaScript payload or phishing URL in the redirect parameter. The attacker distributes this link via email or social engineering targeting users who trust the legitimate site. When the victim clicks the link and the page loads, the reflected payload executes in their browser, potentially stealing session cookies or redirecting them to a credential-harvesting page.