CVE-2026-63047
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
Joomla Extension Events Booking from joomdonation.com versions 5.0.0-5.8.1 did not properly verify that an actor is allowed to download invoice information, leading to data exfiltration.
Risk Assessment
Risk of unauthorized access to sensitive invoice data, potentially compromising customer privacy and financial integrity.
Recommendation
Update the Events Booking extension to a version later than 5.8.1. Verify proper ACL checks.
Other vulnerabilities in Events Booking
See all- CVE-2026-60024Critical
The Joomla extension Events Booking prior to version 5.8.0 by default allows unauthenticated users to upload media assets. This is an insecure default configuration.
- CVE-2026-60025High
The Joomla extension Events Booking prior to version 5.8.0 has a file upload endpoint lacking CSRF protection, allowing user enumeration.
- CVE-2026-58149Medium
The Joomla extension Events Booking before version 5.8.0 is vulnerable to unauthenticated user enumeration, allowing retrieval of usernames and email addresses.
Original NVD description (English source)
Joomla Extension - joomdonation.com - Invoice data exfiltration via incorrect ACL check in Events Booking 5.0.0-5.8.1 - The Joomla extension Events Booking prior version 5.0-5.8.1 did not properly verify that an actor is allowed to download invoice information.