The iCagenda extension for Joomla contains an access control weakness (CWE-284) that permits a backend operator, whose permissions are scoped only to the com_icagenda component, to enumerate Joomla user profiles. This vulnerability affects versions from 4.0.0 up to and including 4.0.11. The vulnerability does not require user interaction and has low complexity to exploit, but it requires high privileges (backend operator access). There is no indication of active exploitation in the wild and no vendor-provided patch or fix information is currently available.

An attacker with backend operator privileges scoped to the iCagenda component can enumerate Joomla user profiles, potentially exposing user information that should be restricted. This could aid in further targeted attacks or privilege escalation attempts. However, the vulnerability does not allow privilege escalation or direct system compromise by itself.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit backend operator permissions carefully and monitor access to the com_icagenda component to reduce risk.