Skip to main content
mySites.guru
Free Audit
J!Awards 2026mySites.guru won a new 2026 award at the Joomla World ConferenceOur awards
CVE-2026-102778MediumCVSS 5.3CVE published 5 October 2026Added to mySites.guru 4 October 2026

Event Gallery (com_eventgallery) below 6.6.0 - CSRF in Backend List Actions, Google Photos Token Leak (SSRF) and Reflected XSS

Event Gallery (Core and Extended) versions before 6.6.0 contain three security flaws, fixed by the vendor in 6.6.0 (4 October 2026). 1) CVE-2026-102776 (vendor advisory EGSA-2026-06, vendor severity 5.1 Medium): eight buttons in the backend lists did not check the Joomla form token (the default payment and shipping method, image type sets, order statuses and watermarks, In shop of an event, the main image of an event and the main-image-only flag, and the sorting of an event's images). A page on another website could trigger them while an administrator was logged in to the backend and change those settings and flags. Nothing could be deleted or read this way and orders were not affected. 2) CVE-2026-102777 (EGSA-2026-07, vendor severity 5.1 Medium): the Google Photos picker on the upload page fetched thumbnails through the server with the Google Photos access token, taking the address from the request without checking it and without a form token. A page on another website could make the server send the Google Photos access token to any address, or fetch addresses inside the server's network, while an administrator was logged in; a backend user allowed to manage Event Gallery could do the same directly. Only sites with a Google Photos account configured are affected, from 5.4.0 on. 3) CVE-2026-102778 (EGSA-2026-08, vendor severity 2.3 Low, CNA CVSS 4.0 5.3 Medium): with the Share article links option switched on (off by default), the page a shared image link opens printed the article address from the link unescaped and, for the Image Page with Redirect link type, followed it, allowing a crafted link to run script in the visitor's session or redirect them to another site; from 3.11.6 on. The Joomla CNA published all three CVE records on 5 October 2026. Update to Event Gallery 6.6.0 or later (it requires Joomla 5.4 or Joomla 6 and PHP 8.2). If you override the backend layout tmpl/files/default.php in your template, take over the star and table-icon buttons from the new file. Until you can update, switch Share article links off (Event Gallery options, tab Social) and avoid browsing other sites while logged in to the backend.

Is my site affected?

Affected
Event Gallery before 6.6.0
Fixed in
6.6.0
What to do
Update Event Gallery to 6.6.0 or later.
Check whether your sites are affected

How CVE-2026-102778 is scored

The base metrics as Joomla CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.

5.3 Medium

CVSS 4.0, scored by Joomla CNA
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

How it is reached

AV:N Attack vector
Network. Reachable across the internet
AC:L Attack complexity
Low. Nothing to work around, it just works
AT:N Attack requirements
None. Works against any affected install
PR:N Privileges required
None. No account needed
UI:P User interaction
Passive. Someone has to visit a page

What it does to the site

VC:L Confidentiality
Low. Some data can be read
VI:L Integrity
Low. Some data can be altered
VA:N Availability
None. The site stays up

What it does beyond the site

SC:N Confidentiality
None. Other systems keep their data
SI:N Integrity
None. Other systems keep their integrity
SA:N Availability
None. Other systems stay up

Timeline

  1. 4 October 2026mySites.guru check added for Event Gallery (before 6.6.0)
  2. 4 October 2026We published: Event Gallery 6.6.0 Fixes Forged Backend Changes and a Google Photos Token Leak
  3. 5 October 2026CVE-2026-102778 record published by its CNA

Rule details

Our disclosure post

Event Gallery 6.6.0 Fixes Forged Backend Changes and a Google Photos Token Leak

Event Gallery 6.6.0 Fixes Forged Backend Changes and a Google Photos Token Leak

Event Gallery 6.6.0 fixes a backend CSRF, a Google Photos token leak and an XSS (CVE-2026-102776 to 102778). Every Joomla site below 6.6.0 needs it.

Other vulnerabilities in Event Gallery

Updating for CVE-2026-102778 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extension.

Event Gallery

Latest safe version: 6.6.0

References

CVE-2026-102778 questions

Which versions are affected by CVE-2026-102778?
CVE-2026-102778 affects Event Gallery before 6.6.0. The fix is in 6.6.0.
How do I fix CVE-2026-102778?
Update Event Gallery to 6.6.0 or later. Then confirm the installed version on the Joomla administrator's Extensions: Manage screen.
How severe is CVE-2026-102778?
Joomla CNA scores it 5.3 (Medium) under CVSS 4.0. In plain terms: reachable across the internet, no account needed and someone has to visit a page.

Running an affected version on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.

This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.

Rules current as of 17 October 2026.