CVE-2026-67366
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The Joomla extension iCagenda before version 2.0.0-4.0.11 contains a CSRF vulnerability in frontend registration actions. Multiple state-changing operations in the frontend are callable without a CSRF token check.
Risk Assessment
An attacker can force an authenticated user to perform unwanted actions, such as changing registration data, which may lead to data integrity issues.
Recommendation
It is recommended to update iCagenda to version 2.0.0-4.0.11 or later, which adds proper CSRF token checks.
Other vulnerabilities in iCagenda
See all- CVE-2026-67365Critical
The Joomla extension iCagenda before version 4.0.0-4.0.11 contains an unauthenticated SQL injection vulnerability in the mod_icagenda_calendar module. It is reachable via com_ajax without requiring a session, token, or account.
- CVE-2026-48939CriticalActively exploited
A vulnerability in the iCagenda extension for Joomla allows arbitrary file upload in the file attachment feature, leading to PHP code upload and execution.
- CVE-2026-75948High
Joomla extension iCagenda 4.0.8 to 4.0.12 has an authenticated stored XSS in the 'Submit an Event' form, where image and file fields are stored without output-side HTML-attribute escaping.
- CVE-2026-71570Medium
The Joomla extension iCagenda before version 2.0.0-4.0.11 contains an ACL bypass vulnerability allowing arbitrary user enumeration. A backend operator with access only to com_icagenda could enumerate Joomla user profiles.
- CVE-2026-71571High
Joomla Extension - icagenda.com - Authenticated SQL injection via unescaped numeric filter in iCagenda < 2.0.0-4.0.11 - Backend operators with permissions to access iCagenda could inject SQL.
Original NVD description (English source)
Joomla Extension - icagenda.com - CSRF on frontend registration actions in iCagenda < 2.0.0-4.0.11 - Multiple state changing operations in the frontend are callable without a CSRF token check.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS