CVE-2026-77035
Received Received - Intake

Cross-user event and venue takeover in Joomla Event Manager

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: Joomla! Project

Description
Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Manager < 5.0.1 - A registered user with edit-own rights (the eventowner=1 setting or core.edit.own) can POST another user's record id together with their own id as created_by and take over that record.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-77035
EUVD
EUVD-2026-66863

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
joomlaeventmanager jem to 5.0.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows a registered user with edit-own rights in Joomla Event Manager (JEM) versions before 5.0.1 to take over another user's event or venue by forging form fields. The attacker can submit their own user ID along with another user's record ID to gain control of that record.

Detection Guidance

Check Joomla Event Manager versions below 5.0.1. Inspect POST requests for forged form fields where eventowner=1 or core.edit.own is manipulated. Review user records for unauthorized changes to created_by fields.

Impact Analysis

An attacker could modify or delete events or venues they do not own, disrupting event management and causing data loss. This could lead to misinformation, reputational damage, or operational disruptions for users relying on JEM for event coordination.

Compliance Impact

This vulnerability could lead to unauthorized modifications or deletions of personal or sensitive data stored in events or venues, potentially violating GDPR (data integrity) or HIPAA (protected health information integrity). Organizations using JEM must ensure data integrity to maintain compliance.

Mitigation Strategies

Upgrade Joomla Event Manager to version 5.0.1 or later. Review and restrict edit-own permissions. Monitor user activity logs for suspicious record modifications. Apply Joomla core security updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77035. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart