CVE-2026-71571 is an authenticated SQL injection vulnerability in the iCagenda extension for Joomla, affecting versions 4.0.0 through 4.0.11. The flaw arises from improper neutralization of special elements in an SQL command, specifically via an unescaped numeric filter. Backend users with appropriate permissions can exploit this to inject arbitrary SQL commands, potentially compromising the database integrity and confidentiality. The vulnerability is classified under CWE-89 and has a CVSS 4.0 score of 8.6, indicating high severity. No official patch or remediation guidance is currently provided, and no known exploits are reported in the wild.

Successful exploitation allows authenticated backend operators to perform SQL injection attacks, which can lead to unauthorized data access, modification, or deletion within the database managed by the iCagenda Joomla extension. This compromises the confidentiality, integrity, and availability of the affected system's data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict backend operator permissions to trusted users only and monitor for suspicious activity related to iCagenda access. Avoid exposing the backend interface to untrusted networks.