Medium severity · published Aug 14, 2026
CVE-2026-71570
Joomla Extension - icagenda.com - ACL bypass allowing arbitrary user enumeration < 2.0.0-4.0.11
5.1
CVSS
0.4%
EPSS
No
On KEV
Description
Joomla Extension - icagenda.com - ACL bypass allowing arbitrary user enumeration < 2.0.0-4.0.11 - A backend operator granted access scoped to `com_icagenda` only could enumerate Joomla user profiles.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IE
iCagenda extension for Joomla · icagenda.com
4.0.0-4.0.11 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-71570
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-71570
www.icagenda.com
https://www.icagenda.com/
More from iCagenda extension for Joomla
9.8
CVE-2026-48939
Joomla Extension - icagenda.com - Remote Code Execution in iCaganda extension for Joomla < 4.0.8/3.9.15
9.2
CVE-2026-67365
Joomla Extension - icagenda.com - Unauthenticated SQL injection in iCagenda < 4.0.0-4.0.11
8.6
CVE-2026-102790
Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12
8.6
CVE-2026-75948
Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12
8.6
CVE-2026-71571
Joomla Extension - icagenda.com - Authenticated SQL injection via unescaped numeric filter in iCagenda < 2.0.0-4.0.11