Joomdle (com_joomdle) 1.0.2 to 3.0.1 - Insecure Default Configuration (Joomla account read and password reset) and Reflected XSS

Joomdle bridges a Joomla site to a Moodle installation. Every release from 0.7.0 up to and including 3.0.1 ships an insecure default configuration (CVE-2026-65881): out of the box the extension exposes read access to Joomla user accounts and allows a password reset of those accounts, so anyone who can reach the integration endpoint can enumerate CMS users and take over an account without ever authenticating to Joomla. The same releases carry a reflected XSS (CVE-2026-65882) in the goto URL parameter of the Moodle wrapper endpoint. Fixed in Joomdle 3.1.1. Update to 3.1.1 or later, then review the Joomdle configuration against the vendor defaults and audit the Joomla user list for unfamiliar accounts and unexpected password changes. NOTE ON THE VERSION FLOOR: this rule starts at 1.0.2 rather than the vendor floor of 0.7.0 because the separate "Xmap - Joomdle Plugin" ships under element com_joomdle at version 1.0.1, and match_extension_type is not currently enforced by the matcher; the floor keeps that sitemap plugin from being flagged. The trade-off is that a genuine Joomdle component below 1.0.2 (0.95 and earlier) is not caught by this rule.

Affected versions: ≥ 1.0.2 and ≤ 3.0.1

Official record: cve.org · NVD

Every connected Joomla site is checked against this rule on each audit, and flagged if it runs an affected version.

Affected extensions and versions