EUVD-2026-58806
GHSA-q2h5-882x-32hv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered CSRF with mandatory user interaction (UI:R); no privileges required by attacker; impact confined to low-integrity modification with no confidentiality or availability effect.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
Joomla Extension - icagenda.com - CSRF on frontend registration actions in iCagenda < 2.0.0-4.0.11 - Multiple state changing operations in the frontend are callable without a CSRF token check.
AnalysisAI
Cross-site request forgery in the iCagenda Joomla extension (versions prior to 4.0.11) exposes multiple frontend state-changing operations - including event registration actions - to forged HTTP requests, because no CSRF token validation is applied to those endpoints. Any Joomla site running a vulnerable iCagenda release allows an attacker to trigger registrations or other frontend mutations on behalf of an authenticated visitor who is socially engineered into loading a crafted page. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the victim holds an active, authenticated session on the target Joomla site and is tricked into loading an attacker-controlled page or clicking a crafted link while that session is live - this is the UI:P condition confirmed by the CVSS 4.0 vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N) reflects a moderate-severity issue: network-reachable, low complexity, requiring no attacker privileges, but gated on user interaction (UI:P) and limited to low-integrity impact on the vulnerable system with no confidentiality or availability consequences. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker hosts a page containing a hidden HTML form that auto-submits a POST request to the target Joomla site's iCagenda frontend registration endpoint. When an authenticated site visitor is lured to that page - via phishing email or malicious link - their browser silently sends the forged registration request with valid session cookies, completing the action without their knowledge or consent. … |
| Remediation | Upgrade the iCagenda Joomla extension to version 4.0.11 or later as the primary remediation; the vendor release and further guidance are available at https://www.icagenda.com/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary PHP file upload in the iCagenda extension for Joomla enables remote unauthenticated attackers to abuse the eve
Stored cross-site scripting in iCagenda Joomla extension versions 4.0.8 through 4.0.12 allows an authenticated event sub
Access control bypass in the iCagenda Event Scheduler Extension for Joomla (all versions prior to 4.0.11) permits authen
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today