CVE-2026-78083: Joomla SP Property CSRF Vulnerability

CVE-2026-78083 is a cross-site request forgery vulnerability in Joomla SP Property extension affecting versions below 4.1.4. Attackers can exploit missing CSRF token verification to submit unauthorized booking and contact forms. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-78083 Overview

CVE-2026-78083 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] affecting the JoomShaper SP Property extension for Joomla in versions prior to 4.1.4. The properties.booking visitor booking endpoint and the agents.sendmail agent contact form submission endpoint process POST requests without verifying Joomla session anti-CSRF tokens. Attackers can trick authenticated visitors into submitting forged requests that create bookings or send agent contact messages on their behalf.

Critical Impact
Attackers can forge property bookings and agent contact submissions through victim browsers, undermining transaction integrity on affected real-estate listing sites.

Affected Products

JoomShaper SP Property extension for Joomla
SP Property versions prior to 4.1.4
Joomla installations exposing properties.booking or agents.sendmail endpoints

Discovery Timeline

2026-09-10 - CVE CVE-2026-78083 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-78083

Vulnerability Analysis

The SP Property extension exposes two POST endpoints that accept state-changing requests without validating a Joomla session token. The properties.booking endpoint creates visitor booking records for listed properties. The agents.sendmail endpoint dispatches contact messages to agents associated with property listings.

Both handlers omit the standard Joomla JSession::checkToken() (or equivalent HTMLHelper::_('form.token')) verification. Any authenticated visitor loading an attacker-controlled page can be coerced into submitting a forged POST request. The server accepts the request because the victim's session cookie is automatically attached by the browser.

The result is unauthorized state changes on behalf of the victim, including fraudulent bookings and spoofed agent inquiries that appear to originate from a legitimate user.

Root Cause

The root cause is missing CSRF token verification on state-changing controller actions. Joomla provides a built-in anti-CSRF token mechanism that must be explicitly validated by each controller handling POST data. The affected endpoints in SP Property versions before 4.1.4 do not invoke this check, violating the framework's security guidance.

Attack Vector

Exploitation requires user interaction. The attacker hosts a malicious page containing an auto-submitting HTML form or a crafted fetch() call targeting the vulnerable endpoint on the victim's Joomla site. When a logged-in visitor visits the attacker page, the browser sends the forged POST with the victim's session cookie. No credentials, privileges, or prior compromise of the Joomla server are required.

The vulnerability manifests in the request handlers for the properties.booking and agents.sendmail tasks. See the JoomShaper SP Property Extension advisory for vendor details.

Detection Methods for CVE-2026-78083

Indicators of Compromise

Unexpected booking records in the SP Property database with mismatched Referer or Origin headers in web server logs.
Agent contact emails whose submission timestamps correlate with external referrers rather than the site's own property pages.
POST requests to index.php?option=com_spproperty&task=properties.booking or task=agents.sendmail lacking a valid Joomla form token parameter.

Detection Strategies

Review Joomla and web server access logs for POST requests to the affected task endpoints with Referer headers pointing to untrusted domains.
Alert on booking or contact submissions that lack the expected token parameter name in the POST body.
Correlate spikes in booking or agent-mail volume with abnormal geographic or referrer distributions.

Monitoring Recommendations

Enable verbose logging on the SP Property component to capture full POST parameter names for auditing.
Deploy a web application firewall (WAF) rule to log requests to the affected endpoints missing a Joomla session token.
Monitor outbound agent-notification email volume for sudden increases indicative of automated abuse.

How to Mitigate CVE-2026-78083

Immediate Actions Required

Upgrade the JoomShaper SP Property extension to version 4.1.4 or later on all Joomla sites.
Audit recent booking and agent contact records for entries generated during the exposure window and validate their legitimacy.
Invalidate long-lived visitor sessions to force reauthentication after applying the patch.

Patch Information

JoomShaper addresses the issue in SP Property 4.1.4 by adding Joomla session token verification to the properties.booking and agents.sendmail handlers. Administrators should install the update through the Joomla Extensions Manager and confirm the running version afterward. Refer to the JoomShaper SP Property Extension product page for the current release.

Workarounds

Restrict access to the vulnerable endpoints via WAF rules that require a valid Referer matching the site's own domain.
Disable the visitor booking and agent contact features until the extension is upgraded.
Enforce a strict SameSite=Lax or SameSite=Strict cookie policy on the Joomla session cookie to reduce cross-site submission risk.

bash

# Example WAF rule to block cross-origin POSTs to affected endpoints
SecRule REQUEST_METHOD "@streq POST" \
  "chain,phase:2,deny,status:403,id:1078083,\
   msg:'CVE-2026-78083 - SP Property CSRF blocked'"
SecRule REQUEST_URI "@rx (properties\.booking|agents\.sendmail)" "chain"
SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-site.example/"