CVE-2026-77035
MediumCVSS 5.1Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
In the Joomla Event Manager extension before version 5.0.1, there is a vulnerability allowing cross-user event and venue takeover through forged form fields. A registered user with edit-own rights (the eventowner=1 setting or core.edit.own) can POST another user's record id together with their own id as created_by and take over that record.
Risk Assessment
The risk is the possibility of taking control over other users' events and venues, which could lead to data manipulation and integrity compromise.
Recommendation
It is recommended to update the Joomla Event Manager extension to version 5.0.1 or later and verify user permissions.
Other vulnerabilities in Joomla Event Manager
See all- CVE-2026-77991Critical
The Joomla Event Manager extension versions below 5.0.1 contain a privileged remote code execution vulnerability. The administrator can write dangerous file types including PHP, leading to remote code execution.
- CVE-2026-77990Medium
In the Joomla Event Manager extension before version 5.0.1, attendee lists are readable by any logged-in user. A non-manager can read attendee names, usernames, registration dates, and statuses for events they do not manage, including lists belonging to unpublished events.
- CVE-2026-77034Medium
In the Joomla Event Manager extension before version 5.0.1, there is a vulnerability allowing unauthenticated article overwrite and force-publish. Any visitor holding their own session token can republish and overwrite an article associated with an event.
Original NVD description (English source)
Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Manager < 5.0.1 - A registered user with edit-own rights (the eventowner=1 setting or core.edit.own) can POST another user's record id together with their own id as created_by and take over that record.