CVE-2026-58149
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The Joomla extension Events Booking before version 5.8.0 is vulnerable to unauthenticated user enumeration, allowing retrieval of usernames and email addresses.
Risk Assessment
Disclosure of usernames and email addresses facilitates social engineering and targeted brute-force attacks on accounts.
Recommendation
Update the Events Booking extension to version 5.8.0 or later.
Other vulnerabilities in Events Booking
See all- CVE-2026-60024Critical
The Joomla extension Events Booking prior to version 5.8.0 by default allows unauthenticated users to upload media assets. This is an insecure default configuration.
- CVE-2026-63047High
Joomla Extension Events Booking from joomdonation.com versions 5.0.0-5.8.1 did not properly verify that an actor is allowed to download invoice information, leading to data exfiltration.
- CVE-2026-60025High
The Joomla extension Events Booking prior to version 5.8.0 has a file upload endpoint lacking CSRF protection, allowing user enumeration.
Original NVD description (English source)
Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0 - The Joomla extension Events Booking is vulnerable to an unauthenticated user enumeration that allows to retrieve account usernames and email addresses.