Vulnerability · Published Aug 27, 2026 · Assigned by Joomla

CVE-2026-77035Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Manager < 5.0.1

Medium 5.1

In plain English

A medium-severity authorization bypass via user-controlled key in JEM - Joomla Event Manager extension for Joomla from joomlaeventmanager.net. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 4.0)5.1Medium

Exploit odds (30 days)0.4%top 66.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Manager < 5.0.1 - A registered user with edit-own rights (the eventowner=1 setting or core.edit.own) can POST another user's record id together with their own id as created_by and take over that record.

Affected products (as reported)

Vendor	Product	Versions
joomlaeventmanager.net	JEM - Joomla Event Manager extension for Joomla	1.0.0-5.0.0

Weakness: CWE-639 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://www.joomlaeventmanager.net/ product