CVE-2026-77991
CriticalCVSS 9.4Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
The Joomla Event Manager extension versions below 5.0.1 contain a privileged remote code execution vulnerability. The administrator can write dangerous file types including PHP, leading to remote code execution.
Risk Assessment
Risk of full server compromise by an administrator who can execute arbitrary code.
Recommendation
Update the Joomla Event Manager extension to version 5.0.1 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Joomla Event Manager
See all- CVE-2026-77990Medium
In the Joomla Event Manager extension before version 5.0.1, attendee lists are readable by any logged-in user. A non-manager can read attendee names, usernames, registration dates, and statuses for events they do not manage, including lists belonging to unpublished events.
- CVE-2026-77035Medium
In the Joomla Event Manager extension before version 5.0.1, there is a vulnerability allowing cross-user event and venue takeover through forged form fields. A registered user with edit-own rights (the eventowner=1 setting or core.edit.own) can POST another user's record id together with their own id as created_by and take over that record.
- CVE-2026-77034Medium
In the Joomla Event Manager extension before version 5.0.1, there is a vulnerability allowing unauthenticated article overwrite and force-publish. Any visitor holding their own session token can republish and overwrite an article associated with an event.
Original NVD description (English source)
Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1 - The administrator source model allows to write dangerous file type incl. PHP, leading to remote code execution.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS