Event Gallery EUVD-2026-92451

Exploitation requires a Joomla administrator to be authenticated with an active back-end session and to visit an attacker-controlled external page while that session is valid (UI:A). The specific affected functionality is the Event Gallery extension's back-end list buttons for eight tasks: setting the default payment method, shipping method, image type set, order status, and watermark; toggling an event in/out of the shop; selecting an event's main image and the main-image-only flag; and sorting event images - all of which fail to validate the form token. Limiting factors: impact is confined to changing these configuration flags (no read, no delete, orders unaffected), the attack needs an active privileged session plus admin interaction, and it is fixed in version 6.6.0, so patched or non-administrator-active deployments are not exploitable.

This is a genuinely medium/low-priority issue, not a high-CVSS alarm. The CVSS 4.0 base score is 5.1 (Medium), and the vector tells a consistent story: AV:N (a malicious web page reaches the victim over the network), AC:L, but UI:A - exploitation absolutely depends on a logged-in administrator visiting an attacker-controlled page. Impact is limited to VI:L (low integrity) with VC:N and VA:N: the description confirms nothing can be read or deleted and orders are unaffected, so only eight configuration flags/settings can be flipped. No EPSS score was provided, there is no CISA KEV listing, and no public POC is referenced, so exploitation status is 'no public exploit identified at time of analysis.' CWE-352 (CSRF) matches the described missing form-token checks exactly, so the signals are internally consistent with no contradictions. Note PR:N reflects that the attacker needs no account of their own, but a real attack still requires an authenticated administrator session in the victim's browser - this social-engineering/session prerequisite, combined with low integrity-only impact, makes this a low real-world risk best handled in routine patching rather than emergency response.

An attacker crafts a malicious web page containing auto-submitting requests to the Event Gallery back-end task endpoints and lures a currently logged-in Joomla administrator to visit it. Because the targeted list-button tasks do not validate a CSRF form token, the browser silently sends the admin's authenticated session cookies and the settings are changed in the administrator's name. No public exploit code is identified, but the technique is standard CSRF and trivial to weaponize.