# CVE-2026-67366: JoomliC iCagenda CSRF on frontend registration actions

Source: https://junglewise.ai/threats/cve-2026-67366-joomlic-icagenda-csrf-on-frontend-registration-actions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-14. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-67366 · Severity: info · Published 2026-08-14

iCagenda is a Joomla extension for creating and managing events on websites. The extension contains a cross-site request forgery (CSRF) vulnerability affecting frontend registration operations, allowing attackers to perform state-changing actions on behalf of legitimate users without proper authorization checks. Exploiting this vulnerability could enable unauthorized event registrations, modifications, or cancellations in affected Joomla installations.

## Quick answers

**Is CVE-2026-67366 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-67366 being exploited in the wild.

**How severe is CVE-2026-67366?** Informational severity, published 14 August 2026.

**Which products and versions are affected?** JoomliC iCagenda < 2.0.0-4.0.11.

**Is there a fix for CVE-2026-67366?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-67366 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-67366?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is a CSRF (cross-site request forgery) affecting multiple state-changing frontend registration operations in iCagenda. The root cause is the absence of CSRF token validation on frontend operations that modify state, such as event registration actions. An attacker can craft a malicious webpage or email containing a crafted request that, when visited by an authenticated user, performs unauthorized actions on their behalf without their knowledge. The attack requires user interaction (the victim must visit the attacker's page while logged in) but requires no authentication from the attacker. Versions before 2.0.0-4.0.11 are affected; patches should be available in version 2.0.0-4.0.11 and later.

## Affected products

- JoomliC iCagenda < 2.0.0-4.0.11

## Timeline

- 2026-08-14: disclosed

## References

- [https://www.icagenda.com/](https://www.icagenda.com/)