CVE-2026-67365 is an unauthenticated SQL injection vulnerability in the iCagenda extension for Joomla, specifically affecting versions 4.0.0 through 4.0.11. The vulnerability is exploitable via the mod_icagenda_calendar component through the com_ajax endpoint without any authentication or session validation. This improper neutralization of special elements in SQL commands (CWE-89) can allow attackers to execute arbitrary SQL queries, potentially compromising data confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, data modification, or disruption of service. The CVSS 4.0 base score of 9.2 indicates a critical severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, restrict access to the com_ajax endpoint if possible and monitor for suspicious activity related to iCagenda. Follow vendor advisories for updates and apply official patches once released.