CVE-2026-77035: CWE-639: Authorization Bypass Through User-Controlled Key in joomlaeventmanager.net JEM - Joomla Event Manager extension for Joomla
Description
A vulnerability in the Joomla Event Manager (JEM) extension for Joomla allows a registered user with edit-own rights to take over other users' event and venue records by submitting forged form fields. This affects versions 1.0.0 through 5.0.0 of the extension. The issue involves authorization bypass through user-controlled keys, enabling cross-user event and venue takeover.
CVSS v4.0
Score 5.1medium
Affected software
joomlaeventmanager.net
JEM - Joomla Event Manager extension for Joomla
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-77035 is an authorization bypass vulnerability in the Joomla Event Manager (JEM) extension for Joomla, identified as CWE-639. A registered user with edit-own permissions can exploit this flaw by POSTing another user's record ID along with their own created_by ID, thereby taking control of that record. This affects JEM versions from 1.0.0 up to and including 5.0.0. The vulnerability allows unauthorized modification of event and venue data belonging to other users.
Potential Impact
An attacker with legitimate edit-own rights can escalate their privileges to modify or take over events and venues owned by other users. This can lead to unauthorized changes in event data, potentially disrupting event management and trust in the system. There is no indication of remote code execution or data disclosure beyond the unauthorized modification of records.
Mitigation Recommendations
No official patch or remediation has been confirmed yet. Users should monitor the vendor advisory for updates. Until a fix is available, restrict edit-own permissions to trusted users only and consider additional access controls or monitoring to detect unauthorized record modifications.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Joomla
- Date Reserved
- 2026-08-20T08:56:32.577Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a8fd7c3acd9273b49e17810
Added to database: 08/27/2026, 06:22:59 UTC
Last enriched: 09/10/2026, 09:10:12 UTC
Last updated: 10/10/2026, 18:48:22 UTC
Views: 88
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.