CVE-2026-100749
Received Received - Intake

CSRF in Event Gallery Joomla Extension

Publication date: 2026-09-27

Last updated on: 2026-09-27

Assigner: Joomla! Project

Description
Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension < 6.5.0 - Only orphaned file entries and shopping carts that are older than 30 days will be deleted.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-27
Last Modified
2026-09-27
Generated
2026-09-27
AI Q&A
2026-09-27
EPSS Evaluated
N/A
NVD
CVE-2026-100749
EUVD
EUVD-2026-87929

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
svenbluege event_gallery to 6.5.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) issue in the Event Gallery Joomla extension versions before 6.5.0. It allows attackers to trick authenticated users into performing cleanup actions in the backend, specifically deleting orphaned file entries and shopping carts older than 30 days.

Detection Guidance

This vulnerability involves CSRF in backend cleanup actions in the Event Gallery Joomla extension versions below 6.5.0. To detect it, check the installed version of the Event Gallery extension in your Joomla admin panel. If it is below 6.5.0, the system is vulnerable.

Impact Analysis

An attacker could exploit this to delete important backend data like orphaned files or old shopping carts without the user's knowledge. This could disrupt normal operations or cause data loss if critical files are removed.

Compliance Impact

The vulnerability involves a CSRF flaw in the Event Gallery Joomla extension allowing unauthorized backend cleanup actions. This could potentially lead to improper data deletion or retention, which may impact compliance with GDPR (data protection) or HIPAA (health data handling) if sensitive user or medical data is involved.

Mitigation Strategies

Immediately update the Event Gallery extension to version 6.5.0 or higher through the Joomla admin panel. If updating is not possible, consider disabling or removing the extension until an update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100749. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart