CVE-2026-77035: Joomlaeventmanager.net Jem - Joomla Event Manager Extension For Joomla

Medium severity, CVSS 5.1. EPSS: 0.4% chance of exploitation in the next 30 days.

Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Manager < 5.0.1 - A registered user with edit-own rights (the eventowner=1 setting or core.edit.own) can POST another user's record id together with their own id as created_by and take over that record.

Affected products

• Joomlaeventmanager.net Jem - Joomla Event Manager Extension For Joomla: version 1.0.0-5.0.0 only

Published 2026-08-27. Last modified 2026-08-28.