CVE-2026-100749 in Event Gallery Extension
Summary
by MITRE • 09/27/2026
Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension < 6.5.0 - Only orphaned file entries and shopping carts that are older than 30 days will be deleted.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/27/2026
The Joomla Event Gallery extension, developed by Sven Bluege and distributed through svenbluege.de, contains a critical Cross-Site Request Forgery vulnerability in its backend cleanup functionality for versions prior to 6.5.0. This security flaw affects the administrative interface where system maintenance tasks are performed, specifically targeting the automated deletion of orphaned file entries and shopping cart data that have exceeded a thirty-day age threshold. The vulnerability arises from an insufficient implementation of anti-CSRF tokens or session validation mechanisms within these specific cleanup actions. As a result, authenticated administrators can be tricked into executing unintended state-changing requests without their explicit knowledge or consent, bypassing the intended security controls designed to protect administrative operations.
From a technical perspective, this flaw represents a classic failure in request verification where the server fails to validate that an incoming request originated from a legitimate user interaction within the application context rather than from a malicious third-party site. The specific actions targeted are data deletion routines, which modify the state of the database by removing records deemed obsolete. Because these operations lack proper cryptographic proof of intent, such as unique per-session tokens or strict referrer validation that is immune to spoofing in certain browser configurations, an attacker can craft a simple HTML page containing a hidden form or image tag pointing to the cleanup endpoint. When an administrator with active privileges visits this malicious page while logged into their Joomla backend, the browser automatically includes session cookies and authentication headers, causing the server to process the deletion request as if it were authorized by the admin.
The operational impact of this vulnerability is significant for website integrity and data availability. While the description notes that only orphaned files and shopping carts older than thirty days are affected, an attacker can manipulate the timing or frequency of these cleanup actions through repeated forgery attempts, potentially leading to a denial-of-service condition if the system becomes unstable due to rapid database modifications. More critically, in environments where Event Gallery is integrated with e-commerce platforms like VirtueMart, the deletion of shopping cart data could result in financial loss for users and reputational damage for the site owner. Furthermore, because this occurs within the backend administrative area, it indicates a broader weakness in how session management and request validation are handled across other potential endpoints in the extension, suggesting that similar vulnerabilities may exist elsewhere in the codebase.
This vulnerability aligns with CWE-352, which defines Cross-Site Request Forgery as an attack that forces an end user to execute unwanted actions on a web application in which they are currently authenticated. It also maps to MITRE ATT&CK technique T1078, specifically Valid Accounts, where attackers leverage existing credentials or sessions to perform malicious activities within the system. The lack of proper CSRF protection places the administrative interface at risk of unauthorized state changes, violating the principle of least privilege and compromising the confidentiality and integrity of administrative operations.
To mitigate this vulnerability, immediate action is required by upgrading the Event Gallery extension to version 6.5.0 or later, where these security flaws have been addressed in subsequent releases. Administrators should also ensure that their Joomla core installation is fully patched, as updates often include improvements to global session handling and CSRF protection mechanisms. Additionally, implementing server-side defenses such as strict referrer policy checks can provide an additional layer of defense against forged requests. Security teams should review the implementation of anti-CSRF tokens in all administrative forms within third-party extensions to ensure that every state-changing action requires a unique, unpredictable token tied to the user's session, thereby preventing unauthorized execution of cleanup or deletion routines by external actors.