Vulnerability · Published Jun 19, 2026 · Assigned by VulnCheck

CVE-2023-54357Joomla com_booking 2.4.9 Information Disclosure via Account Enumeration

High 7.5

In plain English

A high-severity security flaw in Joomla! com_booking component from Artio. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.7%top 48.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Joomla com_booking component 2.4.9 contains an information disclosure vulnerability that allows unauthenticated attackers to enumerate user accounts by exploiting the getUserData function in the customer controller. Attackers can send GET requests to index.php with option=com_booking, controller=customer, task=getUserData, and an id parameter to retrieve user names, usernames, and email addresses through brute force enumeration.

Affected products (as reported)

Vendor	Product	Versions
Artio	Joomla! com_booking component	2.4.9

Weakness: CWE-203 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

ExploitDB-51595 exploit
Official Product Homepage product
Product Reference product
VulnCheck Advisory: Joomla com_booking 2.4.9 Information Disclosure via Account Enumeration third-party-advisory