CVE-2026-77990 Overview
CVE-2026-77990 is an authorization flaw in the Joomla Event Manager extension distributed by joomlaeventmanager.net. Versions prior to 5.0.1 expose attendee lists to any authenticated Joomla user, regardless of that user's role or event ownership. A non-manager account can read attendee names, usernames, registration dates, and registration statuses for events they do not manage. The disclosure extends to attendee lists associated with unpublished events. The weakness is classified as [CWE-639] Authorization Bypass Through User-Controlled Key. The issue affects confidentiality of participant data while leaving integrity and availability intact.
Critical Impact
Any logged-in Joomla user can enumerate attendee records, including personally identifiable information tied to private or unpublished events.
Affected Products
- Joomla Event Manager extension by joomlaeventmanager.net
- All versions prior to 5.0.1
- Joomla sites exposing event registration to authenticated users
Discovery Timeline
- 2026-08-27 - CVE-2026-77990 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-77990
Vulnerability Analysis
The Joomla Event Manager extension exposes attendee list views to any authenticated session. The application checks that a user is logged in but does not verify that the requesting user holds a manager role for the target event. As a result, low-privileged users can request attendee data for arbitrary events by manipulating the event identifier in the request. Because the check happens after authentication but before ownership evaluation, the extension returns records that should remain restricted. The returned data includes usernames, real names, registration timestamps, and current registration statuses. The vulnerability also surfaces attendee lists for events in an unpublished state, which typically indicates events not yet approved for public visibility.
Root Cause
The root cause is a missing authorization check on the attendee list endpoint. The extension trusts the event identifier supplied by the client and does not validate whether the requesting account owns or manages that event. This matches the [CWE-639] pattern, where access control decisions rely on user-controllable keys without server-side ownership verification.
Attack Vector
Exploitation requires only a valid Joomla account with standard registered-user privileges. An attacker authenticates to the target Joomla site, then requests the attendee list view while supplying an event identifier they do not manage. The server returns the attendee data without enforcing role or ownership checks. No user interaction from a victim is required. No specialized tooling is needed beyond a browser or HTTP client capable of issuing authenticated requests.
No public proof-of-concept code is referenced in the advisory. See the Joomla Event Manager website for vendor details.
Detection Methods for CVE-2026-77990
Indicators of Compromise
- Authenticated HTTP requests to attendee list endpoints from accounts that do not own the referenced event.
- Access log entries showing repeated event identifier enumeration by a single low-privileged session.
- Retrieval of attendee data associated with events marked as unpublished.
Detection Strategies
- Review web server logs for requests to Joomla Event Manager attendee views correlated with the requesting user's role in the Joomla user table.
- Alert when non-manager accounts access attendee export or list URLs across multiple distinct event identifiers within a short window.
- Compare authenticated request patterns against expected event ownership to identify horizontal privilege violations.
Monitoring Recommendations
- Ingest Joomla application and web server logs into a centralized analytics platform for role-aware query correlation.
- Baseline normal attendee list access per user role and flag deviations, especially requests referencing unpublished events.
- Monitor for sequential event ID access patterns that suggest automated enumeration of attendee data.
How to Mitigate CVE-2026-77990
Immediate Actions Required
- Upgrade the Joomla Event Manager extension to version 5.0.1 or later on all affected Joomla installations.
- Audit registered Joomla accounts and disable inactive or unknown users that could be leveraged for authenticated access.
- Review recent access logs for attendee list retrieval by non-manager accounts and notify affected registrants if disclosure is confirmed.
Patch Information
The vendor has addressed the flaw in Joomla Event Manager 5.0.1. Administrators should download the fixed release from the Joomla Event Manager website and apply it through the Joomla Extensions Manager. Verify the installed version after upgrade to confirm remediation.
Workarounds
- Restrict Joomla user self-registration until the extension is upgraded to reduce the pool of accounts that can reach authenticated endpoints.
- Temporarily remove or unpublish the Event Manager attendee list views if immediate upgrade is not feasible.
- Apply web server access rules that deny requests to attendee list endpoints from users outside the manager group where enforceable.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
