CVE-2026-77029: CWE-352 Cross-Site Request Forgery (CSRF) in yootheme.com Zoo extension for Joomla

CVE-2026-77029 is a CSRF vulnerability in the yootheme.com Zoo extension for Joomla, affecting versions from 1.0.0 up to and including 4.1.65. The flaw arises because the extension does not implement CSRF tokens on front-end state changes, which can allow an attacker with high privileges to induce a user to perform unwanted state-changing requests. The CVSS 4.0 base score is 4.6, reflecting network attack vector, low attack complexity, required high privileges, user interaction needed, and limited impact on confidentiality and integrity.

An attacker with high privileges could exploit this vulnerability by tricking a user into submitting unauthorized state-changing requests on the front end of the affected Joomla site. This could lead to unintended changes in the application state. However, the impact is limited by the requirement for high privileges and user interaction, resulting in a medium severity rating.

No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious with user privileges and consider implementing additional CSRF protections or workarounds if possible.