EUVD-2026-66865
GHSA-4pgp-q6vx-cg62
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no authentication (guest session token is auto-issued); integrity rated High because the attacker has full control to overwrite and force-publish any targeted event article.
Primary rating from Vendor (joomla).
CVSS VectorVendor: joomla
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in Joomla Event Manager < 5.0.1 - Any visitor holding their own session token can republish and overwrite an article associated with an event.
AnalysisAI
Unauthenticated content tampering in Joomla Event Manager before version 5.0.1 permits any anonymous visitor to overwrite and force-publish articles linked to events on the affected Joomla site. Rooted in CWE-284 (Improper Access Control), the extension fails to enforce authorization before processing article modification requests, treating a routine guest session token - automatically issued to every site visitor - as sufficient proof of permission. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The only prerequisites are that the target Joomla site has Joomla Event Manager prior to version 5.0.1 installed and enabled, and that the attacker can reach the site over the network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The source CVSS 4.0 score of 6.9 with VI:L understates the practical integrity risk: the vulnerability grants an anonymous attacker full control over the content and publication state of any article associated with an event, which in CVSS terms is better characterized as a high integrity impact on affected resources. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Joomla Event Manager to version 5.0.1 or later, which is the vendor-indicated fix version per the CVE description reported by security@joomla.org. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today