CVE-2026-67365 is an unauthenticated SQL injection vulnerability in the iCagenda extension for Joomla, specifically affecting versions 4.0.0 through 4.0.11. The vulnerability is located in the mod_icagenda_calendar component and can be exploited via the com_ajax endpoint without any authentication or session tokens. This improper neutralization of special elements used in SQL commands (CWE-89) can allow attackers to execute arbitrary SQL queries, potentially compromising the confidentiality, integrity, and availability of the underlying database.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to execute arbitrary SQL commands on the backend database. This can lead to unauthorized data disclosure, data modification, or deletion, and potentially full system compromise depending on the database privileges. The CVSS 4.0 score of 9.2 (critical) reflects the high impact and ease of exploitation due to no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, restrict access to the vulnerable endpoints if possible and monitor for suspicious activity related to com_ajax requests targeting the iCagenda extension.