CVE-2026-71570

MediumCVSS 5.1

Published: 14/08/2026(UTC)Updated: 17/08/2026(UTC)Translated: 15/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

16th percentile - higher than 16% of all known CVEs

Summary

The Joomla extension iCagenda before version 2.0.0-4.0.11 contains an ACL bypass vulnerability allowing arbitrary user enumeration. A backend operator with access only to com_icagenda could enumerate Joomla user profiles.

Risk Assessment

The risk is unauthorized disclosure of user data, which may violate privacy and lead to further attacks.

Recommendation

It is recommended to immediately update the iCagenda extension to version 2.0.0-4.0.11 or later, which fixes this vulnerability.

Original NVD description (English source)

Joomla Extension - icagenda.com - ACL bypass allowing arbitrary user enumeration < 2.0.0-4.0.11 - A backend operator granted access scoped to `com_icagenda` only could enumerate Joomla user profiles.