CVE-2026-67366

MediumCVSS 5.3

Published: 14/08/2026(UTC)Updated: 17/08/2026(UTC)Translated: 15/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

5th percentile - higher than 5% of all known CVEs

Summary

The Joomla extension iCagenda before version 2.0.0-4.0.11 contains a CSRF vulnerability in frontend registration actions. Multiple state-changing operations in the frontend are callable without a CSRF token check.

Risk Assessment

An attacker can force an authenticated user to perform unwanted actions, such as changing registration data, which may lead to data integrity issues.

Recommendation

It is recommended to update iCagenda to version 2.0.0-4.0.11 or later, which adds proper CSRF token checks.

Original NVD description (English source)

Joomla Extension - icagenda.com - CSRF on frontend registration actions in iCagenda < 2.0.0-4.0.11 - Multiple state changing operations in the frontend are callable without a CSRF token check.