CVE-2026-58149: Events Booking User Enumeration Flaw

CVE-2026-58149 Overview

CVE-2026-58149 is an information disclosure vulnerability in the Joomla extension Events Booking developed by JoomDonation. Versions before 5.8.0 allow unauthenticated attackers to enumerate valid user accounts. The flaw exposes both usernames and email addresses through the extension's public interface. The vulnerability is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor and requires no authentication or user interaction to exploit.

Critical Impact
Unauthenticated attackers can harvest usernames and email addresses from vulnerable Joomla sites, enabling targeted phishing, credential stuffing, and account takeover campaigns.

Affected Products

JoomDonation Events Booking for Joomla versions prior to 5.8.0
Joomla sites with the Events Booking extension installed
Any Joomla deployment relying on Events Booking for event registration workflows

Discovery Timeline

2026-07-17 - CVE-2026-58149 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-58149

Vulnerability Analysis

The Events Booking extension exposes account information through responses that differ based on whether a queried identifier corresponds to a valid user. An unauthenticated attacker submitting crafted requests to the extension's endpoints can observe these response differences and infer the existence of specific accounts. The flaw enables systematic enumeration of both usernames and associated email addresses across the target site.

The vulnerability is network-exploitable with low attack complexity and requires no privileges or user interaction. Its scope is limited to confidentiality — no data integrity or availability impact is produced by the enumeration itself. However, the harvested identifiers create a foundation for follow-on attacks against the affected Joomla site and its users.

The EPSS probability of exploitation is 0.206%, indicating a low current forecast of active exploitation. Because the flaw is trivial to script and provides direct value for phishing and credential-based attacks, defenders should treat exposure as material even where scoring is moderate.

Root Cause

The root cause is improper handling of responses in registration or lookup workflows within Events Booking. The extension returns distinguishable output when a submitted username or email matches an existing account versus a non-existent one. This behavior violates the principle that authentication and lookup endpoints should return uniform responses regardless of account existence.

Attack Vector

An attacker sends automated requests to public Events Booking endpoints with candidate usernames or email addresses. By parsing the differing responses, the attacker builds a validated list of accounts on the target site. No credentials, tokens, or user interaction are required. The harvested list can then feed phishing kits, password spraying tools, or targeted social engineering against event registrants and administrators.

No verified proof-of-concept code is published in the referenced advisory. Refer to the JoomDonation product page for vendor guidance.

Detection Methods for CVE-2026-58149

Indicators of Compromise

High-volume sequential requests to Events Booking registration, login, or lookup endpoints originating from a single source IP or small IP pool
Repeated form submissions cycling through candidate usernames or email addresses within short time windows
Unusual spikes in HTTP 200 responses to unauthenticated Events Booking endpoints with varying request parameters

Detection Strategies

Deploy web application firewall (WAF) rules that rate-limit and flag repeated requests to Events Booking URLs containing user identifier parameters
Analyze Joomla and web server access logs for enumeration patterns such as sequential email addresses or dictionary-based username submissions
Correlate failed lookup attempts with subsequent phishing email delivery targeting enumerated addresses

Monitoring Recommendations

Enable verbose logging on the Joomla site for all Events Booking component actions, capturing source IP, request parameters, and response codes
Forward web server logs to a centralized SIEM and build detections for anomalous request volume against /index.php?option=com_eventbooking and related paths
Monitor for outbound phishing reports from users whose addresses appear in Events Booking registrations

How to Mitigate CVE-2026-58149

Immediate Actions Required

Upgrade the Events Booking extension to version 5.8.0 or later on all affected Joomla installations
Inventory Joomla sites in the environment to identify every deployment running the vulnerable extension
Review web server and application logs for prior enumeration activity and notify affected users if evidence is found

Patch Information

JoomDonation addresses the vulnerability in Events Booking version 5.8.0. Administrators should download the current release from the JoomDonation Events Booking product page and apply the update through the Joomla extension manager. Verify the installed version after upgrade to confirm remediation.

Workarounds

Place the Joomla site behind a WAF configured to rate-limit requests to Events Booking endpoints until patching is complete
Restrict access to Events Booking registration and lookup pages by IP allowlist where feasible for internal-only deployments
Enforce CAPTCHA on registration and lookup forms to slow automated enumeration attempts

bash

# Example WAF rate-limit rule (ModSecurity syntax) to throttle Events Booking requests
SecRule REQUEST_URI "@contains option=com_eventbooking" \
  "id:1005810,phase:1,pass,nolog,\
   setvar:ip.eb_requests=+1,\
   expirevar:ip.eb_requests=60"
SecRule IP:EB_REQUESTS "@gt 20" \
  "id:1005811,phase:1,deny,status:429,\
   msg:'Events Booking enumeration rate limit exceeded'"