CVE-2026-77035 Overview
CVE-2026-77035 affects the Joomla Event Manager extension from joomlaeventmanager.net in versions prior to 5.0.1. The vulnerability allows a registered user with edit-own permissions to take over event and venue records that belong to other users. An attacker submits a POST request containing another user's record id alongside their own account id in the created_by field. The extension accepts the forged ownership assignment and reassigns the record to the attacker. The flaw is classified as an Insecure Direct Object Reference issue [CWE-639].
Critical Impact
Authenticated users with eventowner=1 or core.edit.own rights can hijack any event or venue record and gain full control over its contents.
Affected Products
- Joomla Event Manager extension from joomlaeventmanager.net
- All versions prior to 5.0.1
- Joomla installations that enable the eventowner=1 setting or grant core.edit.own
Discovery Timeline
- 2026-08-27 - CVE-2026-77035 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-77035
Vulnerability Analysis
The Joomla Event Manager extension exposes edit endpoints that trust client-supplied identifiers without validating record ownership. A user granted the core.edit.own capability is expected to modify only records they created. The extension enforces this constraint by reading the created_by field from the submitted form rather than from the stored record. An attacker posts a form that carries the target record's primary id together with the attacker's own user identifier in created_by. The server persists the modified created_by value, effectively transferring ownership of the target record to the attacker.
Root Cause
The root cause is missing server-side authorization on the record identifier before applying updates. The extension trusts the id and created_by fields from the request body and does not compare the stored created_by value to the current session user. This pattern maps directly to [CWE-639] Authorization Bypass Through User-Controlled Key.
Attack Vector
Exploitation requires an authenticated Joomla account with edit-own privileges on events or venues. The attacker forges a POST request that includes the primary key of a record owned by another user and their own user id in created_by. No user interaction from the victim is required. Successful exploitation results in the attacker becoming the owner of the target event or venue, with the ability to modify or delete its content. Refer to the Joomla Event Manager vendor site for release information.
Detection Methods for CVE-2026-77035
Indicators of Compromise
- Unexpected changes to the created_by column in Joomla Event Manager event and venue tables
- Audit log entries showing a user editing records they did not originally create
- POST requests to Event Manager edit endpoints containing both an id and a created_by value that differs from the stored owner
Detection Strategies
- Compare current created_by values against database backups to identify reassigned records
- Alert on HTTP POST bodies to Event Manager form handlers where created_by is submitted by a non-administrative account
- Correlate authenticated Joomla sessions with edits performed on records whose original owner differs from the acting user
Monitoring Recommendations
- Enable Joomla action logging for the Event Manager component and forward logs to a centralized SIEM
- Track privilege assignments that grant core.edit.own or set eventowner=1
- Review web server access logs for repeated POST requests to event and venue edit URLs from the same session
How to Mitigate CVE-2026-77035
Immediate Actions Required
- Upgrade Joomla Event Manager to version 5.0.1 or later on all Joomla instances
- Audit event and venue records for unexpected created_by changes and restore ownership where required
- Review which user groups hold core.edit.own and remove the permission from accounts that do not need it
Patch Information
The vendor addressed the issue in Joomla Event Manager 5.0.1. Administrators should install the update through the Joomla Extension Manager and verify the running version after upgrade. Product release details are available on the Joomla Event Manager site.
Workarounds
- Disable the eventowner=1 setting until the extension is upgraded
- Restrict event and venue editing to trusted administrators by revoking core.edit.own from general user groups
- Place the Event Manager edit endpoints behind a web application firewall rule that blocks requests containing a client-supplied created_by field
# Verify installed Event Manager version via Joomla CLI
php cli/joomla.php extension:list | grep -i "event manager"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
