CVE-2026-78083: Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Contact Endpoints in SP Property < 4.1.4

Q: Which deployments are affected?

SP Property versions earlier than 4.1.4 are affected. The exposed functionality is limited to the visitor booking and agent contact form submission endpoints.

Q: What must an attacker do to exploit this issue?

An attacker would need to cause a victim to submit a POST request to the properties.booking or agents.sendmail endpoint. The issue exists because those endpoints did not verify Joomla session anti-CSRF tokens.

Q: How can I determine whether my site is vulnerable?

Check the installed SP Property version. Versions earlier than 4.1.4 should be treated as affected, particularly if the visitor booking or agent contact form features are enabled.

Published Sep 10, 2026

Updated

Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Contact Endpoints in SP Property < 4.1.4 - The visitor booking (properties.booking) and agent contact form submission (agents.sendmail) endpoints processed POST requests without verifying Joomla session anti-CSRF tokens.

Affected Software

1 affected component

joomshaper.com SP Property<4.1.4

Event History

Sep 10, 2026

CVE Published

via MITRE·10:01 AM

Data Sourced

via MITRE·10:01 AM

DescriptionWeakness

Frequently Asked Questions

Which deployments are affected?

SP Property versions earlier than 4.1.4 are affected. The exposed functionality is limited to the visitor booking and agent contact form submission endpoints.

What must an attacker do to exploit this issue?

An attacker would need to cause a victim to submit a POST request to the properties.booking or agents.sendmail endpoint. The issue exists because those endpoints did not verify Joomla session anti-CSRF tokens.

How can I determine whether my site is vulnerable?

Check the installed SP Property version. Versions earlier than 4.1.4 should be treated as affected, particularly if the visitor booking or agent contact form features are enabled.