iCagenda (com_icagenda) 4.0.8 to 4.0.11 - Unauthenticated SQL Injection

iCagenda

Affected versions: ≥ 4.0.8 and < 4.0.12

Full advisory: www.icagenda.com

iCagenda Calendar module - iCagenda Calendar module (mod_icagenda_calendar) below 4.0.12 - Unauthenticated SQL Injection

CVE-2026-67365, published by the Joomla CNA on 14 August 2026, is an unauthenticated SQL injection in the iCagenda Calendar module (mod_icagenda_calendar). The CNA describes it as reachable via com_ajax with no session, token or account, and scores it CVSS 4.0 9.2 Critical (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H) under CWE-89. The affected range given in the record is 4.0.0 to 4.0.11, so 4.0.12 is the first release that is not affected. This was reported by Joep van Antwerpen of Onvio, not by mySites.guru. Update the iCagenda package to 4.0.12 or later; if you cannot, unpublish and uninstall the iCagenda Calendar module, because the flaw is reached through that module rather than through the component. Important when you check versions by hand: the module version does not track the package version. The module manifest stayed at 4.0.7 across the 4.0.8, 4.0.9, 4.0.10 and 4.0.11 releases and only moved to 4.0.12, so a site can show iCagenda 4.0.11 in the component list while the vulnerable module still reports 4.0.7. That is why this rule matches the module rather than com_icagenda, and why it starts below 4.0.8 instead of picking up where the earlier iCagenda rules stop. Those earlier rules (com_icagenda below 4.0.8 and below 3.9.15) cover a different flaw, the CISA KEV listed arbitrary file upload CVE-2026-48939, and are unchanged. Note also that as of 17 August 2026 the vendor changelog at icagenda.com lists no entry above 4.0.11, so there is no vendor release note describing this fix.

Affected versions: ≥ 4.0.0 and < 4.0.12

Full advisory: www.cve.org