The iCagenda extension for Joomla, versions 2.0.0 through 4.0.11 inclusive, contains a CSRF vulnerability (CWE-352) affecting frontend registration actions. Multiple operations that change state can be invoked without a CSRF token check, allowing attackers to potentially trick authenticated users into executing unwanted actions. The vulnerability is publicly known and assigned CVE-2026-67366 with a CVSS 4.0 base score of 5.3 (medium severity). No vendor advisory or patch information is available at this time.

Successful exploitation could allow an attacker to perform unauthorized state-changing actions on behalf of an authenticated user via CSRF attacks. This could lead to unintended modifications in the frontend registration process of the iCagenda extension. There is no indication of privilege escalation, data disclosure, or remote code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider implementing additional CSRF protections at the application or web server level, such as validating origin headers or using web application firewalls to detect and block CSRF attempts. Monitor vendor channels for updates.