Executive brief
iCagenda is a Joomla extension for creating and managing events on websites. The extension contains a cross-site request forgery (CSRF) vulnerability affecting frontend registration operations, allowing attackers to perform state-changing actions on behalf of legitimate users without proper authorization checks. Exploiting this vulnerability could enable unauthorized event registrations, modifications, or cancellations in affected Joomla installations.
Technical details
This vulnerability is a CSRF (cross-site request forgery) affecting multiple state-changing frontend registration operations in iCagenda. The root cause is the absence of CSRF token validation on frontend operations that modify state, such as event registration actions. An attacker can craft a malicious webpage or email containing a crafted request that, when visited by an authenticated user, performs unauthorized actions on their behalf without their knowledge. The attack requires user interaction (the victim must visit the attacker's page while logged in) but requires no authentication from the attacker. Versions before 2.0.0-4.0.11 are affected; patches should be available in version 2.0.0-4.0.11 and later.
Affected products
- JoomliC iCagenda < 2.0.0-4.0.11
Timeline
- 2026-08-14: disclosed