Vulnerability · Published Aug 27, 2026 · Assigned by Joomla
CVE-2026-77990Joomla Extension - joomlaeventmanager.net - Attendee lists readable by any logged-in user in Joomla Event Manager < 5.0.1
Medium 5.3
In plain English
A medium-severity authorization bypass via user-controlled key in JEM - Joomla Event Manager extension for Joomla from joomlaeventmanager.net. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).
Official description
Joomla Extension - joomlaeventmanager.net - Attendee lists readable by any logged-in user in Joomla Event Manager < 5.0.1 - A non-manager can therefore read attendee names, usernames, registration dates and statuses for events they do not manage, including lists belonging to unpublished events.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| joomlaeventmanager.net | JEM - Joomla Event Manager extension for Joomla | 1.0.0-5.0.0 |
Weakness: CWE-639 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N