CVE-2026-100748: Joomla Event Gallery CSRF Vulnerability

CVE-2026-100748 Overview

CVE-2026-100748 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] affecting the Event Gallery extension for Joomla, developed by Sven Bluege. The flaw exists in multiple cart action handlers in versions prior to 6.5.0. Attackers can trick authenticated users into submitting unintended cart requests by visiting attacker-controlled pages. The vulnerability requires no privileges and no user credentials from the attacker but relies on a victim's active session with the Joomla site.

Critical Impact
Attackers can manipulate cart state and perform unauthorized cart actions on behalf of authenticated Joomla users running Event Gallery versions earlier than 6.5.0.

Affected Products

Joomla Event Gallery extension by svenbluege.de
All versions prior to 6.5.0
Joomla sites with the Event Gallery component enabled

Discovery Timeline

2026-09-27 - CVE-2026-100748 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-100748

Vulnerability Analysis

The Event Gallery extension exposes several cart action endpoints that process state-changing requests without validating an anti-CSRF token. An attacker who hosts a malicious page can craft HTML forms or image tags that trigger these endpoints when loaded by a victim with an active Joomla session. The browser automatically attaches session cookies, allowing the forged request to execute under the victim's identity. The impact is limited to integrity of cart state. Confidentiality and availability are not affected based on the published scoring vector.

Root Cause

The root cause is the absence of a server-side CSRF token check on cart action handlers. Joomla provides a token mechanism through JSession::checkToken() and JHtml::_('form.token'), but the vulnerable cart actions do not enforce it. Any state-changing endpoint that relies solely on session cookies for authorization is susceptible to request forgery.

Attack Vector

Exploitation is network-based and does not require authentication or user interaction with the vulnerable site beyond having an active session. The attacker lures a victim to a page containing an auto-submitting form or embedded request targeting the Event Gallery cart action URL. Because no origin or token validation occurs, the request is processed as legitimate. See the Sven Bluege Personal Website for extension details and advisories.

Detection Methods for CVE-2026-100748

Indicators of Compromise

Unexpected cart modifications or orders associated with user sessions that did not originate from the Joomla front-end.
HTTP POST requests to Event Gallery cart action endpoints with Referer or Origin headers pointing to external domains.
Access log entries showing cart action requests immediately following cross-site navigation events.

Detection Strategies

Review web server access logs for Event Gallery cart endpoints and correlate the Referer header against trusted origins.
Instrument Joomla to log session identifiers alongside cart state changes to detect anomalies.
Monitor for bursts of cart actions from a single session with mismatched referrers.

Monitoring Recommendations

Forward Joomla and web server logs to a centralized SIEM for correlation across sessions and IPs.
Build alerts for cart action requests lacking valid anti-CSRF tokens once patched versions are deployed.
Track Event Gallery extension version inventory across Joomla instances to prioritize patching.

How to Mitigate CVE-2026-100748

Immediate Actions Required

Upgrade the Event Gallery extension to version 6.5.0 or later on all Joomla installations.
Audit cart activity logs for suspicious state changes dating back to the extension's installation.
Notify users of the vulnerable extension and advise them to log out of the Joomla site when not in use.

Patch Information

The vendor addressed the issue in Event Gallery version 6.5.0. Administrators should obtain the updated extension from the Joomla Extensions Directory or from the Sven Bluege Personal Website. Verify installation by confirming the extension version in the Joomla administrator panel after upgrade.

Workarounds

Temporarily disable the Event Gallery extension until the patched version is installed.
Restrict access to the cart functionality through server-side rules that validate the Referer and Origin headers.
Deploy a Web Application Firewall rule to block cart action requests missing a valid Joomla form token.

bash

# Example WAF/mod_security rule to require same-origin referer on cart actions
SecRule REQUEST_URI "@contains /index.php?option=com_eventgallery" \
  "chain,phase:2,deny,status:403,id:1002026100748,msg:'CVE-2026-100748 CSRF mitigation'"
SecRule REQUEST_METHOD "@streq POST" "chain"
SecRule &REQUEST_HEADERS:Referer "@eq 0"