The Balbooa Forms extension for Joomla contains an authorization bypass vulnerability (CWE-639) in versions 1.0.0 through 2.4.3.3. The removeTmpAttachment action accepts an integer attachment ID and deletes the corresponding database row and file. While the controller checks a Joomla session token to prevent CSRF, the model fails to bind the attachment ID to the uploading session, user, form, or temporary state. This flaw allows an attacker to delete attachments without proper authorization by using a valid session token from their own session.

An attacker can delete attachments uploaded by other users without authorization. This could lead to data loss or disruption of form functionality. The vulnerability does not require privileges or user interaction beyond obtaining a valid session token, making it accessible to unauthenticated users. There is no indication of remote code execution or privilege escalation from this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Balbooa Forms extension and monitor for suspicious deletion activity. Avoid exposing the removeTmpAttachment action to unauthenticated users if possible.