Skip to main content

Joomla Event Manager CVE-2026-77034

| EUVDEUVD-2026-66865 MEDIUM
Improper Access Control (CWE-284)
2026-08-27 security@joomla.org GHSA-4pgp-q6vx-cg62
Authentication Bypass
6.9
CVSS 4.0 · Vendor: joomla
Share

Severity by source

Vendor (joomla) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Network-reachable with no authentication (guest session token is auto-issued); integrity rated High because the attacker has full control to overwrite and force-publish any targeted event article.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (joomla).

CVSS VectorVendor: joomla

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

1
Analysis Generated
Aug 27, 2026 - 07:20 vuln.today

DescriptionCVE.org

Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in Joomla Event Manager < 5.0.1 - Any visitor holding their own session token can republish and overwrite an article associated with an event.

AnalysisAI

Unauthenticated content tampering in Joomla Event Manager before version 5.0.1 permits any anonymous visitor to overwrite and force-publish articles linked to events on the affected Joomla site. Rooted in CWE-284 (Improper Access Control), the extension fails to enforce authorization before processing article modification requests, treating a routine guest session token - automatically issued to every site visitor - as sufficient proof of permission. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Visit public Joomla site
Delivery
Receive automatic guest session token
Exploit
Enumerate event-linked article IDs from public pages
Execution
Craft HTTP POST to article-update endpoint with session token
Persist
Submit attacker-controlled article body
Impact
Force-publish tampered content publicly
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The only prerequisites are that the target Joomla site has Joomla Event Manager prior to version 5.0.1 installed and enabled, and that the attacker can reach the site over the network. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The source CVSS 4.0 score of 6.9 with VI:L understates the practical integrity risk: the vulnerability grants an anonymous attacker full control over the content and publication state of any article associated with an event, which in CVSS terms is better characterized as a high integrity impact on affected resources. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker visits any publicly accessible Joomla site running an unpatched Joomla Event Manager installation and automatically receives a guest session cookie from the server. Using that session token, the attacker submits a crafted HTTP POST request to the extension's article-update endpoint with an enumerated event-article ID and arbitrary replacement content. …
Remediation Upgrade Joomla Event Manager to version 5.0.1 or later, which is the vendor-indicated fix version per the CVE description reported by security@joomla.org. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-284 – Improper Access Control

View all
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8
CVE-2025-12480 CRITICAL POC
9.1

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-77034 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy