CVE-2026-77034: Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in Joomla Event Manager < 5.0.1

Q: Which deployments are affected?

Joomla sites using Joomla Event Manager versions earlier than 5.0.1 are affected.

Q: What does an attacker need to exploit this issue?

The attacker needs to be a site visitor with their own session token. No further privileges are stated in the available information.

Q: What can an attacker do after exploitation?

An attacker can overwrite and republish an article associated with an event.

Published Aug 27, 2026

Updated

Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in Joomla Event Manager < 5.0.1 - Any visitor holding their own session token can republish and overwrite an article associated with an event.

Affected Software

1 affected component

Joomla Joomla Event Manager<5.0.1

Event History

Aug 27, 2026

CVE Published

via MITRE·05:48 AM

Data Sourced

via MITRE·05:48 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Joomla sites using Joomla Event Manager versions earlier than 5.0.1 are affected.

What does an attacker need to exploit this issue?

The attacker needs to be a site visitor with their own session token. No further privileges are stated in the available information.

What can an attacker do after exploitation?