CVE-2026-63047 PUBLISHED

Joomla Extension - joomdonation.com - Invoice data exfiltration via incorrect ACL check in Events Booking 5.0.0-5.8.1

Assigner: Joomla
Reserved: 15.07.2026 Published: 22.07.2026 Updated: 22.07.2026

The Joomla extension Events Booking prior version 5.0-5.8.1 did not properly verify that an actor is allowed to download invoice information.

Product Status

Vendor joomdonation.com
Product Events Booking extension for Joomla
Versions Default: unaffected
  • Version 5.0-5.8.1 is affected

Credits

  • Phil Taylor finder

References

Problem Types

  • CWE-284 Improper Access Control CWE

Impacts

  • CAPEC-569: Collect Data as Provided by Users