Executive brief
Joomla Event Manager is an extension for managing events and venues in Joomla websites. A user with basic event-editing permissions can exploit a flaw in form handling to take over events and venues created by other users by manipulating form fields to claim ownership of those records. This allows unauthorized users to modify or delete other users' event data.
Technical details
The vulnerability is an insecure direct object reference and privilege escalation flaw in the form submission handling. A registered user with edit-own rights (core.edit.own capability or eventowner=1 setting) can POST another user's record ID together with their own ID in the created_by field, allowing them to claim ownership and take over events and venues. The flaw exists because the application fails to properly validate that the user submitting the form is authorized to edit that specific record. The vulnerability affects Joomla Event Manager versions before 5.0.1, and is fixed in version 5.0.1.
Affected products
- JEM Project Joomla Event Manager < 5.0.1
Timeline
- 2026-08-27: disclosed
- 2026-09-14: patched: Fixed in JEM 5.0.1