Vulnerability · Published Aug 19, 2026 · Assigned by Joomla

CVE-2026-67363Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2

High 7.7

In plain English

A high-severity security flaw in Balbooa Forms extension for Joomla from balbooa.com. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 4.0)7.7High

Exploit odds (30 days)0.6%top 53.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2 - The stripeCharges and payAuthorize endpoints accept the charge total from a client-controlled request parameter and forward it to the payment gateway without recomputing it from the form's configured product prices. Neither endpoint enforces authentication or CSRF checks. An unauthenticated attacker can purchase any priced item for an arbitrary amount (e.g., $0.01), and can additionally forge line items, quantities, and shipping.

Affected products (as reported)

Vendor	Product	Versions
balbooa.com	Balbooa Forms extension for Joomla	1.0.0-2.4.3.1

Weakness: CWE-472, CWE-602 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N

References

https://www.balbooa.com/ product