EUVD-2026-66863
GHSA-chh3-v86w-gm49
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable form submission, low complexity; PR:L because core.edit.own is a standard registered-user ACL, not an administrative privilege; integrity-only impact.
Primary rating from Vendor (joomla).
CVSS VectorVendor: joomla
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Manager < 5.0.1 - A registered user with edit-own rights (the eventowner=1 setting or core.edit.own) can POST another user's record id together with their own id as created_by and take over that record.
AnalysisAI
Insecure Direct Object Reference (IDOR) in Joomla Event Manager before version 5.0.1 allows authenticated event-owner users to take over events and venues belonging to other users by manipulating form fields in POST requests. Any registered user holding the eventowner=1 role or core.edit.own ACL permission can forge the record ID and created_by fields to reassign another user's event or venue record to themselves. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold a valid registered-user account on the target Joomla site AND have been granted either the eventowner=1 extension-specific setting or the core.edit.own Joomla ACL permission for the Event Manager component - this is not a default anonymous or unauthenticated attack. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector provided by the vendor scores this at 5.1 with PR:H, AV:N, AC:L, VI:L - a medium-severity issue with limited integrity impact and no confidentiality or availability consequences. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated event organizer on a multi-user Joomla site with Joomla Event Manager installed identifies a target event or venue record ID by browsing the public event listing or enumerating IDs. The attacker crafts a POST request to the event edit endpoint, substituting the target record's ID in the form while setting created_by to their own user ID, causing the application to reassign ownership of the victim's event to the attacker. … |
| Remediation | Upgrade Joomla Event Manager to version 5.0.1 or later, which is the vendor-indicated fix version per the CVE description. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today