CVE-2026-102776: CWE-352 Cross-Site Request Forgery (CSRF) in svenbluege.de Event Gallery for Joomla
Description
Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension < 6.6.0 - Eight tasks which the buttons of the back-end lists call did not check the form token: setting the default payment method, shipping method, image type set, order status and watermark; putting an event into the shop or taking it out; choosing the main image of an event and whether an image is shown only as the main image; and sorting the images of an event. A prepared page on another web site could trigger them in the name of a logged in administrator and change those settings and flags. Nothing can be deleted or read this way; orders are not affected.
CVSS v4.0
Score 5.1medium
Affected software
svenbluege.de
Event Gallery for Joomla
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Event Gallery extension for Joomla (versions up to 6.6.0) suffers from a CSRF vulnerability (CWE-352) where eight backend list tasks do not verify form tokens. These tasks include setting default payment and shipping methods, image type sets, order status, watermark settings, toggling event shop inclusion, selecting main event images, and sorting event images. An attacker can craft a malicious webpage that, when visited by a logged-in administrator, triggers these actions without their consent. The vulnerability does not permit data deletion, data reading, or order manipulation.
Potential Impact
An attacker can cause a logged-in administrator to unknowingly change various configuration settings and flags related to event gallery management. However, the vulnerability does not allow unauthorized data access, deletion, or modification of orders. The impact is limited to unauthorized changes in backend settings.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious when visiting untrusted websites while logged into the Joomla backend. Implementing additional CSRF protections or disabling affected functionalities temporarily may reduce risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Joomla
- Date Reserved
- 2026-09-29T16:46:15.044Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ac3ce172cdf04f65618b273
Added to database: 10/05/2026, 16:19:35 UTC
Last enriched: 10/05/2026, 16:33:43 UTC
Last updated: 10/05/2026, 21:24:54 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.