CVE-2026-102776 in Event Gallery Extension
Summary
by MITRE • 10/05/2026
Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension < 6.6.0 - Eight tasks which the buttons of the back-end lists call did not check the form token: setting the default payment method, shipping method, image type set, order status and watermark; putting an event into the shop or taking it out; choosing the main image of an event and whether an image is shown only as the main image; and sorting the images of an event. A prepared page on another web site could trigger them in the name of a logged in administrator and change those settings and flags. Nothing can be deleted or read this way; orders are not affected.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/05/2026
The Event Gallery extension for Joomla, specifically versions prior to 6.6.0, contains a critical Cross-Site Request Forgery vulnerability within its administrative backend interface. This flaw affects eight distinct list tasks that are triggered by user interactions with buttons in the back-end lists. The affected operations include setting default payment and shipping methods, configuring image types such as order status and watermark settings, managing event visibility in the shop context, selecting main images for events, controlling whether an image is displayed exclusively as a main image, and sorting event images. These actions are fundamental to the configuration and management of gallery content but lack essential security controls against unauthorized state changes initiated by external parties.
The core technical flaw lies in the absence of form token validation for these specific backend tasks. In secure web applications, particularly those involving administrative functions, it is standard practice to implement anti-CSRF tokens within forms or AJAX requests to ensure that a request originates from an authorized user who intentionally performed the action. The Event Gallery extension fails to verify this token when processing changes related to payment methods, shipping configurations, image settings, and event shop status. Consequently, any logged-in administrator whose session is active can be tricked into executing these commands without their explicit consent or knowledge.
An attacker can exploit this vulnerability by crafting a malicious webpage containing hidden forms or JavaScript that automatically submits requests to the vulnerable Joomla endpoints on behalf of the victim. When an administrator visits this prepared page while authenticated in another tab, the browser will attach session cookies associated with the Joomla site, allowing the forged request to be processed as if it were legitimate. This allows the attacker to alter critical configuration settings and visual flags within the gallery backend. For instance, an attacker could change default payment or shipping methods, potentially disrupting business operations or causing financial discrepancies depending on how these defaults are applied globally. Similarly, altering image display settings or event shop status can impact user experience and content visibility.
Despite the severity of this vulnerability regarding administrative control integrity, there are specific limitations to its impact that must be noted for accurate risk assessment. The attack vector is restricted to modifying configuration flags and visual presentation settings; it does not permit data exfiltration nor does it allow for the deletion of existing records or orders. This means that while an attacker can disrupt operational workflows by changing defaults or hiding content, they cannot directly steal sensitive customer order data or destroy historical transaction logs through this specific flaw. However, the ability to silently alter business-critical settings like payment and shipping methods remains a significant risk to administrative integrity and potentially financial accuracy if those defaults are used for new transactions without further verification.
From a classification perspective, this vulnerability aligns with CWE-352, which describes Cross-Site Request Forgery (CSRF). The lack of anti-CSRF tokens represents a failure in implementing adequate security measures against unauthorized state changes. In the context of the MITRE ATT&CK framework, this exploitation technique falls under T1076, known as Remote File Execution via Web Shell or similar mechanisms where an attacker leverages trusted sessions to perform actions, though more specifically it relates to T1534 which involves Internal Spearphishing if social engineering is used to lure the admin. However, technically it is a direct exploitation of session management weaknesses categorized under privilege escalation through unauthorized state changes.
To mitigate this vulnerability, immediate action should be taken by updating the Event Gallery extension to version 6.6.0 or later where these form token checks have been implemented. Until an update is available, administrators can employ several defensive measures. Enabling browser extensions that block third-party cookies or restrict cross-site requests can reduce the risk of automated CSRF attacks. Additionally, ensuring that administrative sessions expire quickly after inactivity reduces the window of opportunity for such exploits. It is also advisable to review server-side logs for unusual patterns of configuration changes originating from unexpected IP addresses or user agents, although this is a reactive rather than preventive measure. Ultimately, patching the software remains the most effective and permanent solution to close these security gaps and restore trust in the administrative interface's integrity.