CVE-2026-67363: Balbooa Forms Auth Bypass Vulnerability

CVE-2026-67363 Overview

CVE-2026-67363 is a business logic vulnerability in the Balbooa Forms Joomla extension prior to version 2.4.3.2. The stripeCharges and payAuthorize endpoints accept the payment total from a client-controlled request parameter and forward it to the payment gateway without server-side validation against configured product prices. Neither endpoint enforces authentication or Cross-Site Request Forgery (CSRF) checks. An unauthenticated attacker can purchase priced items for arbitrary amounts, such as $0.01, and forge line items, quantities, and shipping data. The flaw maps to [CWE-472: External Control of Assumed-Immutable Web Parameter].

Critical Impact
Unauthenticated remote attackers can tamper with payment totals and complete purchases at attacker-chosen prices, causing direct financial loss to site operators.

Affected Products

Balbooa Forms Joomla extension versions prior to 2.4.3.2
Joomla sites using Balbooa Forms with Stripe payment integration
Joomla sites using Balbooa Forms with payment authorization workflows

Discovery Timeline

2026-08-19 - CVE-2026-67363 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-67363

Vulnerability Analysis

The vulnerability resides in two payment-handling endpoints exposed by Balbooa Forms: stripeCharges and payAuthorize. Both endpoints receive the payment total as a request parameter supplied by the client. The server forwards this value directly to the payment gateway without recomputing the total from the form's stored product configuration.

The endpoints do not require authentication. They also lack CSRF token validation. This combination allows any remote actor to invoke the payment flow and specify arbitrary values for the amount, line items, quantities, and shipping charges. The payment gateway processes the transaction based on the manipulated total because it treats the merchant server as authoritative.

Root Cause

The root cause is trust in client-supplied pricing data. The application assumes the price parameter is immutable in transit, which is the exact condition described by CWE-472. Server-side price recomputation from stored form configuration is missing. The absence of authentication and CSRF controls compounds the flaw by removing all barriers to invocation.

Attack Vector

An attacker crafts an HTTP request to the vulnerable stripeCharges or payAuthorize endpoint on any Joomla site running Balbooa Forms below version 2.4.3.2. The attacker sets the total amount to an arbitrary value, populates line items and quantities, and submits the request. The payment gateway charges the attacker-controlled total, and the site records a completed order. No credentials or user interaction on the target site are required.

See the Balbooa Security Information page for vendor guidance and further technical detail.

Detection Methods for CVE-2026-67363

Indicators of Compromise

Payment gateway transactions with totals inconsistent with configured product prices in Balbooa Forms
Orders containing line items, quantities, or shipping values that do not match any published form configuration
Requests to stripeCharges or payAuthorize endpoints originating from clients without prior session establishment or referrer headers
Successful charges completing without an associated authenticated Joomla session

Detection Strategies

Reconcile every Balbooa Forms transaction against the server-side product catalog and flag any total below expected minimums
Enable verbose web server access logging on /index.php?option=com_baforms* requests and search for the stripeCharges and payAuthorize tasks
Correlate Stripe or payment processor webhooks against Joomla application logs to identify transactions with no matching authenticated user context

Monitoring Recommendations

Alert on payment charges below a defined threshold, such as one dollar, for any product-bearing form
Monitor for high-volume POST requests to Balbooa Forms endpoints from single source IP addresses
Track chargebacks and refund requests as a lagging indicator of exploitation

How to Mitigate CVE-2026-67363

Immediate Actions Required

Upgrade Balbooa Forms to version 2.4.3.2 or later on all Joomla installations
Audit all payment transactions processed by Balbooa Forms since deployment for anomalous totals
Contact the payment processor to review recent charges for signs of amount tampering and initiate reversals where appropriate
Temporarily disable Balbooa Forms payment functionality until patching is confirmed

Patch Information

The vendor has released Balbooa Forms 2.4.3.2, which addresses the vulnerability. Refer to the Balbooa Security Information page for the official release and upgrade instructions. The fixed version is expected to enforce server-side price recomputation and add authentication or token checks on payment endpoints.

Workarounds

Restrict access to stripeCharges and payAuthorize endpoints at the web server or Web Application Firewall (WAF) layer until the patch is applied
Add a reverse-proxy rule that rejects requests to these endpoints containing client-supplied amount parameters below a configured minimum
Disable the Balbooa Forms component in Joomla administration if payment collection is not business-critical

bash

# Configuration example
# Apache mod_rewrite rule to block unauthenticated payment endpoint access
RewriteEngine On
RewriteCond %{QUERY_STRING} (task=stripeCharges|task=payAuthorize) [NC]
RewriteCond %{HTTP_COOKIE} !joomla_user_state=logged_in
RewriteRule ^index\.php - [F,L]