CVE-2026-77029: Joomla Zoo Extension CSRF Vulnerability

CVE-2026-77029 Overview

CVE-2026-77029 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the YOOtheme Zoo extension for Joomla in versions prior to 4.1.66. The extension is missing anti-CSRF tokens on front-end state-changing operations, allowing attackers to trick authenticated users into performing unintended actions. The issue is tracked under CWE-352.

Critical Impact
An attacker can coerce a privileged, authenticated user into submitting attacker-crafted requests that alter application state, leading to limited integrity impact within the Zoo component.

Affected Products

YOOtheme Zoo extension for Joomla
Zoo versions prior to 4.1.66
Joomla installations using the vulnerable Zoo component

Discovery Timeline

2026-08-21 - CVE-2026-77029 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-77029

Vulnerability Analysis

The Zoo extension exposes front-end endpoints that change application state without validating a per-request anti-CSRF token. When a signed-in user visits an attacker-controlled page, the browser automatically attaches the user's Joomla session cookie to any outbound request to the target site. The Zoo endpoint accepts and processes the request as if the user initiated it.

Because the endpoint does not require a synchronizer token, origin check, or equivalent protection, an attacker can compose HTML forms or JavaScript that trigger state changes in the victim's session. The CVSS 4.0 metrics indicate user interaction is required and that the impact is limited to integrity on the vulnerable component. Confidentiality and availability are not directly affected.

Root Cause

The root cause is the absence of CSRF protection on front-end handlers that mutate state. The Zoo code paths in versions prior to 4.1.66 do not verify a Joomla form token (JSession::checkToken() or equivalent) before executing privileged actions, leaving the endpoints reliant on ambient session authentication alone.

Attack Vector

Exploitation requires an authenticated, privileged Zoo user to load attacker-controlled content in a browser holding a valid session cookie. The attacker hosts a page that issues cross-origin POST or GET requests to the vulnerable Zoo endpoint. On visit, the victim's browser submits the request with session credentials attached, and the server processes the state change. No credential theft or code execution primitive is required. See the YOOtheme Official Website for vendor advisories and version details.

Detection Methods for CVE-2026-77029

Indicators of Compromise

Unexpected state changes in Zoo content (items, categories, or configuration) that do not correlate with legitimate administrator activity in Joomla audit logs.
Web server access logs showing POST or GET requests to Zoo front-end endpoints with Referer headers pointing to third-party or unknown origins.
Cross-origin requests to Zoo action URLs missing a Joomla form token parameter.

Detection Strategies

Inspect Joomla and web server logs for requests to Zoo action endpoints whose Origin or Referer header does not match the site's own domain.
Correlate Zoo state modification events with authenticated administrator session activity to flag actions with no matching interactive session.
Deploy a web application firewall rule to alert on state-changing requests to Zoo endpoints that lack the expected token parameter.

Monitoring Recommendations

Enable verbose Joomla action logging for the Zoo component and ship logs to a centralized SIEM for retention and correlation.
Monitor administrator and privileged-user browser sessions for anomalous outbound navigations preceding Zoo state changes.
Track version drift across Joomla sites to identify installations still running Zoo builds prior to 4.1.66.

How to Mitigate CVE-2026-77029

Immediate Actions Required

Upgrade the YOOtheme Zoo extension to version 4.1.66 or later on every affected Joomla instance.
Instruct privileged Zoo users to log out of the Joomla administrative session when not actively using it, reducing the window for CSRF abuse.
Review Zoo content and configuration for unauthorized changes made prior to patching.

Patch Information

The vendor has addressed the missing CSRF token issue in Zoo 4.1.66. Administrators should download the fixed release from the YOOtheme Official Website and apply it through the Joomla extension manager. Verify the installed version under Joomla's extension list after the update completes.

Workarounds

Restrict access to Joomla administrative and privileged front-end paths to trusted IP ranges using web server or reverse proxy rules.
Configure browsers or corporate policy to isolate administrator sessions from general browsing activity until the patch is applied.
Deploy a WAF rule that rejects state-changing requests to Zoo endpoints when the Origin or Referer header does not match the site's canonical hostname.

bash

# Example Apache rule to block cross-origin state changes to Zoo endpoints
<LocationMatch "/index.php">
    SetEnvIfNoCase Referer "^https?://your-site\.example/" local_ref=1
    <RequireAll>
        Require all granted
        Require env local_ref
    </RequireAll>
</LocationMatch>