CVE-2026-77029
Received Received - Intake

Missing CSRF Protection in Zoo Joomla Extension

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: Joomla! Project

Description
Joomla Extension - yootheme.com - Missing CSRF tokens on front-end state changes in Zoo < 4.1.66

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-77029
EUVD
EUVD-2026-63934

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
yootheme yootheme_pro to 4.1.66 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a missing Cross-Site Request Forgery (CSRF) token protection in the Zoo extension for Joomla, specifically in versions before 4.1.66. CSRF tokens are used to prevent unauthorized state changes on a website by ensuring actions are intentional and authenticated.

Impact Analysis

An attacker could trick a user into performing unintended actions on a Joomla site using the Zoo extension, such as modifying content or settings without their consent. This could lead to unauthorized changes, data manipulation, or potential site compromise.

Compliance Impact

The vulnerability involves missing CSRF tokens on front-end state changes in the Joomla extension Zoo, which could allow unauthorized actions. This may impact compliance by potentially enabling unauthorized data modifications or access, but specific effects on GDPR or HIPAA are not detailed in the provided context.

Mitigation Strategies

Update the Zoo extension to version 4.1.66 or later to address the missing CSRF tokens issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77029. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart