CVE-2026-58149 describes a user enumeration vulnerability in the Events Booking extension for Joomla, versions 1.0 up to 5.8.0. An unauthenticated attacker can exploit this flaw to enumerate valid account usernames and email addresses. The vulnerability is categorized under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The CVSS v3.1 base score is 5.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact. No vendor advisory or patch information is provided, and no known exploits are reported in the wild.

The vulnerability allows an unauthenticated attacker to obtain usernames and email addresses of users registered in the Events Booking extension, potentially facilitating further targeted attacks such as phishing or credential stuffing. There is no impact on integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the affected extension or monitoring for suspicious enumeration activity. Avoid exposing the vulnerable extension to untrusted networks if possible.