CVE-2026-102776: Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension < 6.6.0
Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension < 6.6.0 - Eight tasks which the buttons of the back-end lists call did not check the form token: setting the default payment method, shipping method, image type set, order status and watermark; putting an event into the shop or taking it out; choosing the main image of an event and whether an image is shown only as the main image; and sorting the images of an event. A prepared page on another web site could trigger them in the name of a logged in administrator and change those settings and flags. Nothing can be deleted or read this way; orders are not affected.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Joomla sites using the svenbluege.de Event Gallery extension earlier than 6.6.0 are affected when an administrator is logged in to the backend and visits an attacker-controlled page.
What can an attacker change through this CSRF issue?
An attacker can cause backend list actions to change payment, shipping, image type, order-status, and watermark defaults; alter whether an event is in the shop; select an event’s main image; restrict an image to main-image display; and reorder event images.
Can this issue expose data, delete content, or alter orders?
No. The described CSRF actions cannot read or delete data, and orders are not affected.