CVE-2026-77990: CWE-639: Authorization Bypass Through User-Controlled Key in joomlaeventmanager.net JEM - Joomla Event Manager extension for Joomla

CVE-2026-77990 is an authorization bypass vulnerability (CWE-639) in the Joomla Event Manager (JEM) extension for Joomla. In affected versions prior to 5.0.1, non-manager users can access attendee lists of events they do not have management rights for. This unauthorized access exposes personal and registration details of attendees, including for unpublished events. The vulnerability arises from improper authorization checks on user-controlled keys used to access event data.

Any logged-in user can read sensitive attendee information for events they do not manage, potentially violating privacy and confidentiality. This includes attendee names, usernames, registration dates, and statuses, even for unpublished events. There is no indication of privilege escalation or remote code execution. The impact is limited to unauthorized information disclosure.

No official patch or remediation level is currently provided. Users should monitor the vendor's advisory for updates and apply any forthcoming patches promptly. Until a fix is available, restrict user access to trusted individuals and consider disabling the extension if sensitive attendee data exposure is a concern.