The iCagenda extension for Joomla versions 2.0.0 up to and including 4.0.11 is affected by a CWE-352 Cross-Site Request Forgery vulnerability. Multiple frontend registration operations that change state can be invoked without a CSRF token check, allowing attackers to trick authenticated users into submitting unwanted requests. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. No official patch or remediation level has been published yet, and there are no known exploits in the wild.

Successful exploitation could allow an attacker to perform unauthorized state-changing actions on behalf of an authenticated user in the frontend registration process. This could lead to unintended modifications or registrations without user consent. However, the impact is limited by the need for user interaction (UI required) and no privileges or authentication are required to initiate the attack.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider implementing additional CSRF protections at the web server or application firewall level or restrict access to vulnerable frontend registration features. Monitor official icagenda.com and Joomla advisories for updates.