CVE-2026-71570

Received Received - Intake

ACL Bypass in iCagenda Joomla Extension

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: Joomla! Project

Description

Joomla Extension - icagenda.com - ACL bypass allowing arbitrary user enumeration < 2.0.0-4.0.11 - A backend operator granted access scoped to `com_icagenda` only could enumerate Joomla user profiles.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-14

Last Modified

2026-08-14

Generated

2026-08-15

AI Q&A

2026-08-15

EPSS Evaluated

N/A

NVD

CVE-2026-71570

EUVD

EUVD-2026-58805

Affected Vendors & Products

Vendor	Product	Version / Range
joomla	icagenda	to 2.0.0-4.0.11 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability is an ACL bypass in the Joomla Extension icagenda.com affecting versions before 2.0.0-4.0.11. It allows a backend operator with limited access to com_icagenda to enumerate Joomla user profiles beyond their intended scope.

Detection Guidance

To detect this vulnerability, check the version of the icagenda extension in your Joomla installation. If it is below 2.0.0-4.0.11, the system is vulnerable. Review user access logs for unauthorized enumeration attempts.

Impact Analysis

An attacker with limited backend access could exploit this to gather sensitive user information, potentially leading to further attacks like phishing or unauthorized access to user accounts.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection principles or HIPAA's patient privacy requirements, potentially resulting in legal penalties and reputational damage.

Mitigation Strategies

Update the icagenda extension to version 2.0.0-4.0.11 or later immediately. Restrict backend operator access to only necessary components and review user permissions for any unauthorized changes.

Hi! I’m here to help you understand CVE-2026-71570. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70