Medium severity · published Aug 14, 2026
CVE-2026-67366
Joomla Extension - icagenda.com - CSRF on frontend registration actions in iCagenda < 2.0.0-4.0.11
5.3
CVSS
0.2%
EPSS
No
On KEV
Description
Joomla Extension - icagenda.com - CSRF on frontend registration actions in iCagenda < 2.0.0-4.0.11 - Multiple state changing operations in the frontend are callable without a CSRF token check.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IE
iCagenda extension for Joomla · icagenda.com
2.0.0-4.0.11 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-67366
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-67366
www.icagenda.com
https://www.icagenda.com/
More from iCagenda extension for Joomla
9.8
CVE-2026-48939
Joomla Extension - icagenda.com - Remote Code Execution in iCaganda extension for Joomla < 4.0.8/3.9.15
9.2
CVE-2026-67365
Joomla Extension - icagenda.com - Unauthenticated SQL injection in iCagenda < 4.0.0-4.0.11
8.6
CVE-2026-102790
Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12
8.6
CVE-2026-75948
Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12
8.6
CVE-2026-71571
Joomla Extension - icagenda.com - Authenticated SQL injection via unescaped numeric filter in iCagenda < 2.0.0-4.0.11