CVE-2026-102776 Overview
CVE-2026-102776 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the Event Gallery extension for Joomla, developed by svenbluege.de. The flaw affects versions prior to 6.6.0 and resides in eight back-end list task handlers that fail to validate form tokens. An attacker who tricks a logged-in administrator into visiting a crafted page can trigger administrative state changes in the extension without the administrator's consent.
Critical Impact
A remote attacker can silently modify Event Gallery back-end settings in the context of an authenticated administrator by inducing them to load an attacker-controlled page.
Affected Products
- Joomla Event Gallery extension by svenbluege.de
- All versions prior to 6.6.0
- Joomla installations with the vulnerable extension enabled
Discovery Timeline
- 2026-10-05 - CVE-2026-102776 published to NVD
- 2026-10-06 - Last updated in NVD database
Technical Details for CVE-2026-102776
Vulnerability Analysis
The Event Gallery extension exposes eight back-end list task endpoints that execute state-changing operations without verifying a per-session form token. These tasks are triggered by buttons on administrator list views and include: setting the default payment method, setting the default shipping method, choosing the default image type set, setting the default order status, applying a default watermark, toggling whether an event is in the shop, selecting the main image of an event, controlling whether an image is shown only as the main image, and sorting the images of an event.
Because the handlers accept requests without a CSRF token, any origin can submit forged requests that the administrator's browser will deliver with valid session cookies. The vulnerability does not expose read access or deletion. Order data remains unaffected.
Root Cause
The root cause is the absence of a form token check [CWE-352] in the task handlers invoked by the Event Gallery back-end list buttons. Joomla provides a built-in JSession::checkToken() mechanism that the affected tasks do not call. State-changing requests are therefore accepted based solely on the administrator's active session cookie.
Attack Vector
An attacker hosts a page containing auto-submitting forms or image tags that target the vulnerable Joomla administrator endpoints. When a logged-in administrator loads that page in the same browser, the browser attaches the Joomla session cookie to the forged request. The affected task executes with administrator privileges, altering the Event Gallery configuration or event state. User interaction is required, which is reflected in the vector string, but no credentials are needed from the attacker.
No verified public exploit code is available for this issue. Refer to the Sven Bluege Security Blog for vendor-published technical details.
Detection Methods for CVE-2026-102776
Indicators of Compromise
- Unexpected changes to Event Gallery default payment method, shipping method, image type set, order status, or watermark settings
- Events toggled into or out of the shop without a corresponding administrator action in audit logs
- Changes to the main image selection or image sort order of events that do not match administrator activity
- HTTP POST requests to Event Gallery back-end task URLs with Referer headers pointing to external domains
Detection Strategies
- Review Joomla access logs for requests to Event Gallery administrator task endpoints that lack a valid form token parameter
- Correlate administrative configuration changes with authenticated administrator browsing activity to flag unattended modifications
- Alert on cross-origin Referer or Origin headers on requests reaching the Joomla administrator path
Monitoring Recommendations
- Ingest Joomla and web server access logs into a centralized log platform and retain them for CSRF investigation timelines
- Monitor for anomalous bursts of back-end task invocations originating from a single administrator session
- Track Event Gallery configuration state over time and alert on out-of-band changes
How to Mitigate CVE-2026-102776
Immediate Actions Required
- Upgrade the Event Gallery Joomla extension to version 6.6.0 or later
- Instruct administrators to log out of the Joomla back end when not actively managing the site
- Audit current Event Gallery settings and event flags against the last known-good configuration
Patch Information
The vendor addressed the issue in Event Gallery 6.6.0 by adding form token validation to the affected back-end task handlers. Consult the Sven Bluege Security Blog for release notes and upgrade instructions.
Workarounds
- Restrict access to the Joomla administrator path by source IP address at the web server or firewall layer
- Require administrators to use a dedicated browser or browser profile that does not visit untrusted sites during administrative sessions
- Deploy a web application firewall rule that rejects requests to Event Gallery administrator task endpoints when the Referer or Origin header is cross-site
# Example Apache configuration restricting administrator access by source IP
<Location "/administrator">
Require ip 203.0.113.0/24
</Location>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
