CVE-2026-67363: Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2
Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2 - The stripeCharges and payAuthorize endpoints accept the charge total from a client-controlled request parameter and forward it to the payment gateway without recomputing it from the form's configured product prices. Neither endpoint enforces authentication or CSRF checks. An unauthenticated attacker can purchase any priced item for an arbitrary amount (e.g., $0.01), and can additionally forge line items, quantities, and shipping.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Joomla Extension (balbooa.com) - Balbooa Formsto a version that resolves this vulnerability.Fixed in 2.4.3.2 - Configuration
Modify the stripeCharges and payAuthorize endpoints in Balbooa Forms to reject unauthenticated requests and require CSRF protection instead of accepting client-controlled parameters.
Joomla Extension (balbooa.com) - Balbooa Forms Authentication/CSRF enforcement on endpoints stripeCharges and payAuthorize = Require authentication and CSRF validation - Configuration
Update stripeCharges and payAuthorize so they recompute the charge total from the form’s configured product prices on the server, and do not forward any client-controlled charge total/line-item/quantity/shipping parameters without server-side validation.
Joomla Extension (balbooa.com) - Balbooa Forms Payment amount source of truth = Recompute charge total server-side from configured product prices
Event History
Frequently Asked Questions
Who can exploit this issue?
No account or prior authentication is required. An unauthenticated remote attacker can submit requests to the stripeCharges or payAuthorize payment endpoints.
What does an attacker need to manipulate a payment?
The attacker needs to control the client-side request sent to a vulnerable payment endpoint. They can supply an arbitrary charge total and can forge line items, quantities, and shipping data because the server does not recompute pricing from the configured product prices.
Are installations using priced forms at risk?
Installations running Balbooa Forms versions earlier than 2.4.3.2 are affected where the stripeCharges or payAuthorize endpoints are used. The issue applies to payment processing for priced items, not merely to authenticated form users.
What should be done if immediate patching is not possible?
Restrict or disable access to the vulnerable stripeCharges and payAuthorize payment functionality until it can be updated. Do not rely on authentication or CSRF protections for these endpoints, as neither is enforced.
How can an administrator identify potentially affected systems?
Check whether Balbooa Forms is installed at a version earlier than 2.4.3.2 and whether Stripe or Authorize payment processing uses the stripeCharges or payAuthorize endpoints. Review payment records for totals that do not match configured product prices, including unusually low amounts and inconsistent line items, quantities, or shipping details.