Affected versions: ≥ 4.0.8 and < 4.0.12
Full advisory: www.icagenda.com
CVE-2026-67365CriticalCVSS 9.2
iCagenda (com_icagenda) 4.0.8 to 4.0.11 - Unauthenticated SQL Injection
iCagenda 4.0.8 through 4.0.11 (the Joomla 4/5/6 branch) contain an unauthenticated SQL injection in mod_icagenda_calendar, reachable through com_ajax with no session, token or account (CVE-2026-67365, CVSS 4.0 9.2 Critical). An anonymous visitor can read arbitrary database contents including Joomla user password hashes. This is a separate flaw from the earlier CVE-2026-48939 file upload RCE and was reported by Joep van Antwerpen of Onvio. Fixed in 4.0.12; update to 4.0.13 or later, which also fixes a stored XSS regression introduced in 4.0.8. The legacy Joomla 3 branch (3.9.x) is not affected by this SQL injection.
Affected versions: ≥ 4.0.8 and < 4.0.12
Official record: cve.org · NVD
Every connected Joomla site is checked against these rules on each audit, and flagged if it runs an affected version.
How CVE-2026-67365 is scored
The base metrics as Joomla CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.
9.2 Critical
CVSS 4.0, scored by Joomla CNACVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:HHow it is reached
- AV:N Attack vector
- Network. Reachable across the internet
- AC:L Attack complexity
- Low. Nothing to work around, it just works
- AT:P Attack requirements
- Present. Needs a particular deployment or race to line up
- PR:N Privileges required
- None. No account needed
- UI:N User interaction
- None. Nobody has to be tricked into anything
What it does to the site
- VC:H Confidentiality
- High. Everything the site holds can be read
- VI:L Integrity
- Low. Some data can be altered
- VA:L Availability
- Low. The site slows or stutters
What it does beyond the site
- SC:H Confidentiality
- High. Data on other systems can be read
- SI:H Integrity
- High. Other systems can be altered
- SA:H Availability
- High. Other systems can be taken down
Affected extensions and versions
iCagenda Calendar module - iCagenda Calendar module (mod_icagenda_calendar) below 4.0.12 - Unauthenticated SQL Injection
CVE-2026-67365, published by the Joomla CNA on 14 August 2026, is an unauthenticated SQL injection in the iCagenda Calendar module (mod_icagenda_calendar). The CNA describes it as reachable via com_ajax with no session, token or account, and scores it CVSS 4.0 9.2 Critical (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H) under CWE-89. The affected range given in the record is 4.0.0 to 4.0.11, so 4.0.12 is the first release that is not affected. This was reported by Joep van Antwerpen of Onvio, not by mySites.guru. Update the iCagenda package to 4.0.12 or later; if you cannot, unpublish and uninstall the iCagenda Calendar module, because the flaw is reached through that module rather than through the component. Important when you check versions by hand: the module version does not track the package version. The module manifest stayed at 4.0.7 across the 4.0.8, 4.0.9, 4.0.10 and 4.0.11 releases and only moved to 4.0.12, so a site can show iCagenda 4.0.11 in the component list while the vulnerable module still reports 4.0.7. That is why this rule matches the module rather than com_icagenda, and why it starts below 4.0.8 instead of picking up where the earlier iCagenda rules stop. Those earlier rules (com_icagenda below 4.0.8 and below 3.9.15) cover a different flaw, the CISA KEV listed arbitrary file upload CVE-2026-48939, and are unchanged. Note also that as of 17 August 2026 the vendor changelog at icagenda.com lists no entry above 4.0.11, so there is no vendor release note describing this fix.
Affected versions: ≥ 4.0.0 and < 4.0.12
Full advisory: www.cve.org
Running an affected version on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
Rules current as of 27 September 2026.