CVE-2026-102776
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
60/100
Published: 2026-10-05
Modified: 2026-11-05
First seen: 2026-11-05
Status: active
Attack Surface
Network
Low Complexity
No Auth
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
Active
S:
X
AT:
None
VC:
None
VI:
Low
VA:
None
Description
Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension < 6.6.0 - Eight tasks which the buttons of the back-end lists call did not check the form token: setting the default payment method, shipping method, image type set, order status and watermark; putting an event into the shop or taking it out; choosing the main image of an event and whether an image is shown only as the main image; and sorting the images of an event. A prepared page on another web site could trigger them in the name of a logged in administrator and change those settings and flags. Nothing can be deleted or read this way; orders are not affected.
Weakness Classification (1)
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| svenbluege | event_gallery | < 6.6.0 |
| svenbluege.de | Event Gallery for Joomla | 1.0.0-6.5.0 |
References & Advisories (1)
product