EUVD-2026-66864
GHSA-839q-fphm-4fh3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable IDOR requiring a valid Joomla login (PR:L) with read-only disclosure of attendee metadata; no scope change, integrity, or availability impact.
Primary rating from Vendor (joomla).
CVSS VectorVendor: joomla
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
Joomla Extension - joomlaeventmanager.net - Attendee lists readable by any logged-in user in Joomla Event Manager < 5.0.1 - A non-manager can therefore read attendee names, usernames, registration dates and statuses for events they do not manage, including lists belonging to unpublished events.
AnalysisAI
Broken object-level authorization in Joomla Event Manager before 5.0.1 allows any authenticated Joomla user to read attendee lists - including names, usernames, registration dates, and statuses - for events they do not manage. The exposure extends to unpublished events, meaning data intended to remain private before an event goes live is also accessible. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires at minimum a valid, active Joomla session at the lowest authenticated privilege tier (e.g., Registered or Subscriber role) - unauthenticated anonymous visitors cannot exploit this flaw. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.3 and associated vector correctly reflect a medium-severity, low-complexity, read-only confidentiality flaw requiring only a valid Joomla login. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated Joomla user with a standard Registered-level account navigates to or directly requests the attendee list endpoint for an event they have no management rights over, supplying the event's identifier in the request. By iterating through sequential or enumerable event IDs, the attacker can systematically harvest attendee names, usernames, registration dates, and statuses across all events on the site, including those not yet published. … |
| Remediation | Upgrade Joomla Event Manager to version 5.0.1 or later, as confirmed by the CVE description as the fixed release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today