Affected versions: ≥ 5.0.0 and < 5.8.2
Full advisory: our disclosure post
CVE-2026-63047MediumPublished 20 July 2026
Events Booking (com_eventbooking) 5.x below 5.8.2 - Unauthenticated Invoice IDOR (billing data disclosure, fixed 5.8.2, CVE-2026-63047)
Events Booking for Joomla had an unauthenticated Insecure Direct Object Reference (IDOR) in the front-end invoice download. The access check only confirmed that a download code was present, not that it matched the requested registration, so an anonymous visitor could download any registrant's invoice (full name, organisation, postal address, email address and payment amount) by iterating the numeric id. Affects the current 5.x line only (5.0.0 up to and including 5.8.1); the legacy Joomla 3 line (4.9.x and below) does not have the vulnerable invoice-download code and is not affected. Fixed in 5.8.2. Note the fix was also silently backported into the 5.8.1 package before the 5.8.2 release, so a site reporting 5.8.1 cannot be assumed patched: update to 5.8.2 to be sure. Read-only disclosure (no write/RCE). Assigned CVE-2026-63047 via the Joomla CNA (published 22 July 2026, crediting Phil Taylor of mySites.guru). Discovered and disclosed by mySites.guru.
Affected versions: ≥ 5.0.0 and < 5.8.2
Official record: cve.org · NVD
Every connected Joomla site is checked against this rule on each audit, and flagged if it runs an affected version.
Affected extensions and versions
Our disclosure post
Running an affected version on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
Rules current as of 30 August 2026.