CVE-2026-77034
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
In the Joomla Event Manager extension before version 5.0.1, there is a vulnerability allowing unauthenticated article overwrite and force-publish. Any visitor holding their own session token can republish and overwrite an article associated with an event.
Risk Assessment
The risk is the possibility of unauthorized modification of article content, which could lead to dissemination of false information or data corruption.
Recommendation
It is recommended to update the Joomla Event Manager extension to version 5.0.1 or later and restrict access to article editing.
Other vulnerabilities in Joomla Event Manager
See all- CVE-2026-77991Critical
The Joomla Event Manager extension versions below 5.0.1 contain a privileged remote code execution vulnerability. The administrator can write dangerous file types including PHP, leading to remote code execution.
- CVE-2026-77990Medium
In the Joomla Event Manager extension before version 5.0.1, attendee lists are readable by any logged-in user. A non-manager can read attendee names, usernames, registration dates, and statuses for events they do not manage, including lists belonging to unpublished events.
- CVE-2026-77035Medium
In the Joomla Event Manager extension before version 5.0.1, there is a vulnerability allowing cross-user event and venue takeover through forged form fields. A registered user with edit-own rights (the eventowner=1 setting or core.edit.own) can POST another user's record id together with their own id as created_by and take over that record.
Original NVD description (English source)
Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in Joomla Event Manager < 5.0.1 - Any visitor holding their own session token can republish and overwrite an article associated with an event.