CVE-2026-102777: Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery extension < 6.6.0
Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery extension < 6.6.0 - The Google Photos picker of the back-end upload page fetches the thumbnails of the picked images through the server, with the OAuth access token of the Google Photos account. The task took the address to fetch from the request without checking it and asked for no form token. A prepared page on another web site could therefore make the server send the access token of the account to any address, or fetch addresses inside the server's network, in the name of a logged in administrator; a back-end user with the permission "Manage" could do the same directly. The token is valid for about an hour and reaches what the picker session of the account reaches.
Affected Software
Event History
Frequently Asked Questions
Who can trigger the vulnerable request?
A logged-in Joomla administrator can be induced to trigger it by visiting a prepared page on another website. A back-end user with the "Manage" permission can also invoke it directly.
What can an attacker achieve through this issue?
The server can be made to fetch an attacker-chosen address, including addresses on the server's internal network. The request can also send the OAuth access token for the administrator's Google Photos account to an attacker-controlled address.
Does exploitation require a valid Joomla form token?
No. The affected task did not require a form token, enabling a prepared external page to cause the request in the context of a logged-in administrator.
What access does an exposed OAuth token provide?
The token is valid for about one hour and has access equivalent to what the affected account's Google Photos picker session can access.