CVE-2026-100749: Event Gallery Joomla Extension CSRF Flaw

CVE-2026-100749 Overview

CVE-2026-100749 is a Cross-Site Request Forgery (CSRF) vulnerability in the Event Gallery extension for Joomla, developed by svenbluege.de. The flaw affects versions prior to 6.5.0 and resides in backend cleanup actions. An attacker who can trick an authenticated administrator into visiting a crafted page can trigger deletion of orphaned file entries and shopping carts older than 30 days. The vulnerability is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact
An authenticated high-privilege user can be coerced into executing unintended cleanup actions, resulting in deletion of orphaned file entries and expired shopping cart data.

Affected Products

Joomla Event Gallery extension by svenbluege.de
All versions prior to 6.5.0
Backend cleanup action endpoints

Discovery Timeline

2026-09-27 - CVE-2026-100749 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-100749

Vulnerability Analysis

The Event Gallery extension exposes backend cleanup actions without adequate anti-CSRF token validation. Authenticated administrators who browse to an attacker-controlled page can have their session cookies replayed against the Joomla backend. The browser issues the cleanup request on behalf of the administrator without their knowledge or consent.

The scope of the attack is bounded by the cleanup logic itself. Only orphaned file entries and shopping cart records older than 30 days are removed. The vulnerability does not provide a path to arbitrary data deletion, code execution, or credential theft.

Exploitation requires that the attacker lure an authenticated administrator into loading a malicious page while a valid Joomla session is active. No user interaction beyond page visit is required once the victim is authenticated.

Root Cause

The root cause is missing or improperly validated anti-CSRF tokens on backend cleanup endpoints. State-changing operations in the Joomla backend should enforce token checks through Joomla's built-in JSession::checkToken() or equivalent. The affected endpoints accept requests without verifying the origin or token, allowing cross-origin form submissions to perform cleanup actions.

Attack Vector

The attack vector is network-based and exploits a browser-mediated flow. An attacker hosts a page containing an auto-submitting HTML form or image tag that targets the vulnerable cleanup endpoint of a Joomla installation. When an authenticated administrator visits the page, the browser attaches session cookies to the request. The backend processes the cleanup action because the session is valid and no token is required.

Full technical details are referenced on the Sven Bluege Personal Website.

Detection Methods for CVE-2026-100749

Indicators of Compromise

Unexpected deletion of orphaned Event Gallery file entries from the backend database
Shopping cart records older than 30 days being removed outside of scheduled maintenance windows
Backend cleanup action HTTP requests with external Referer headers in web server logs
Administrator session activity hitting cleanup endpoints without a corresponding backend navigation trail

Detection Strategies

Review Joomla access logs for POST or GET requests to Event Gallery cleanup action URLs that originate from off-site referrers
Correlate administrator login times with cleanup action timestamps to identify requests issued outside active admin sessions
Enable Joomla extension audit logging to record backend state-changing operations

Monitoring Recommendations

Alert on any HTTP request to Event Gallery backend cleanup endpoints that lacks a Joomla CSRF token parameter
Monitor web application firewall (WAF) logs for cross-origin requests targeting /administrator/ paths
Track database row-count deltas on Event Gallery tables storing file entries and shopping carts

How to Mitigate CVE-2026-100749

Immediate Actions Required

Upgrade the Event Gallery extension to version 6.5.0 or later on all Joomla installations
Audit administrator accounts and revoke sessions that may have been active while browsing untrusted content
Restrict Joomla backend /administrator/ access by IP allowlist where feasible
Enforce browser isolation or dedicated admin workstations for Joomla administrators

Patch Information

The vendor addressed CVE-2026-100749 in Event Gallery version 6.5.0. Administrators should download the updated extension from the vendor and apply it through the Joomla Extension Manager. Refer to the Sven Bluege Personal Website for release details.

Workarounds

Block external referrers to /administrator/ paths at the web server or WAF layer until the patch is applied
Require administrators to log out of the Joomla backend when not actively performing administrative tasks
Deploy a browser extension or site-isolation policy that prevents cross-origin form submissions to the Joomla backend domain

bash

# Example Apache configuration to block cross-origin POST requests to Joomla admin
<LocationMatch "^/administrator/">
    SetEnvIfNoCase Referer "^https?://your-joomla-domain\.tld/" local_ref
    <RequireAll>
        Require all granted
        Require env local_ref
    </RequireAll>
</LocationMatch>