CVE-2026-77989MediumCVSS 5.3CVE published 27 August 2026Added to mySites.guru 27 August 2026

JEM - Joomla Event Manager (com_jem) below 5.0.1 - Privileged Remote Code Execution, Unauthenticated Article Overwrite and Force-Publish, Cross-User Event and Venue Takeover, Reflected XSS and Attendee Data Disclosure

Q: Which versions are affected by CVE-2026-77989?

CVE-2026-77989 affects JEM - Joomla Event Manager before 5.0.1. The fix is in 5.0.1.

Q: How do I fix CVE-2026-77989?

Update JEM - Joomla Event Manager to 5.0.1 or later. Then confirm the installed version on the Joomla administrator's Extensions: Manage screen.

Q: How severe is CVE-2026-77989?

Joomla CNA scores it 5.3 (Medium) under CVSS 4.0. In plain terms: reachable across the internet, no account needed and someone has to visit a page.

JEM (Joomla Event Manager) by the JEM Community is affected by multiple vulnerabilities confirmed live against JEM 5. The Joomla Security Strike Team assigned five CVE IDs on 22 August 2026 and published all five records on 27 August 2026: CVE-2026-77991, CVE-2026-77034, CVE-2026-77035, CVE-2026-77989 and CVE-2026-77990. Every record gives the affected range as 1.0.0 to 5.0.0. There is still no stable version to update to. The fixes exist only in a public 5.0.1 release candidate (the 5.0.1-bugfixes branch on GitHub). The newest stable release remains 5.0.0-stable, from 8 July 2026, which is affected. Confirmed issues: (1) Privileged remote code execution (CVE-2026-77991, CVSS 9.4 Critical) - the administrator source model writes dangerous file types including PHP, giving code execution to an account that already holds administrator access. (2) Unauthenticated article overwrite and force-publish (CVE-2026-77034, CVSS 6.9) - the front-end event.updateAssociatedArticle task performs no ACL check before writing a Joomla content article, so any visitor holding their own session token can republish and overwrite an article associated with an event, including publishing an unpublished one. (3) Cross-user event and venue takeover (CVE-2026-77035, CVSS 5.1) - allowEdit() trusts jform[created_by] and jform[access] from POST data, so a registered user with edit-own rights (the eventowner=1 setting or core.edit.own) can POST another user's record id together with their own id as created_by and take over that record. (4) Reflected XSS via the PDF export link (CVE-2026-77989, CVSS 5.3) - buildCurrentPdfLink copies the current request query string into the PDF button URL and pdfbutton() echoes it unescaped (attribute injection, no tags required). (5) Attendee data disclosure (CVE-2026-77990, CVSS 5.3) - any logged-in non-manager can read attendee names, usernames, registration dates and statuses for events they do not manage, including lists belonging to unpublished events. One further item found by code reading, stored XSS through unescaped category names, has no CVE. Mitigation until 5.0.1 stable ships: restrict front-end event and venue editing and the front-end attendees view to trusted users only, consider disabling front-end event submission, and review who holds administrator access on the site given the source-model file write. Update to JEM 5.0.1 or later as soon as a stable release is available. This rule flags every JEM version below 5.0.1, which matches the affected range stated in all five CVE records.

Is my site affected?

Affected: JEM - Joomla Event Manager before 5.0.1
Fixed in: 5.0.1
What to do: Update JEM - Joomla Event Manager to 5.0.1 or later.

Check whether your sites are affected

How CVE-2026-77989 is scored

The base metrics as Joomla CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.

5.3 Medium

CVSS 4.0, scored by Joomla CNA

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

How it is reached

AV:N Attack vector: Network. Reachable across the internet
AC:L Attack complexity: Low. Nothing to work around, it just works
AT:N Attack requirements: None. Works against any affected install
PR:N Privileges required: None. No account needed
UI:P User interaction: Passive. Someone has to visit a page

What it does to the site

VC:L Confidentiality: Low. Some data can be read
VI:L Integrity: Low. Some data can be altered
VA:L Availability: Low. The site slows or stutters

What it does beyond the site

SC:N Confidentiality: None. Other systems keep their data
SI:N Integrity: None. Other systems keep their integrity
SA:N Availability: None. Other systems stay up

The rule below is rated Critical for the set of 5 CVEs it covers together, not for this record on its own.

Timeline

22 August 2026We published: Five Security Issues in JEM (Joomla Event Manager), and No Stable Fix Yet
27 August 2026CVE-2026-77989 record published by its CNA
27 August 2026mySites.guru check added for JEM - Joomla Event Manager (before 5.0.1)

Rule details

CriticalCVE-2026-77034 CVE-2026-77035 CVE-2026-77989 CVE-2026-77990 CVE-2026-779912026-08-27

JEM - Joomla Event Manager

Affected versions: < 5.0.1

Full advisory: our disclosure post

Our disclosure post

Five Security Issues in JEM (Joomla Event Manager), and No Stable Fix Yet

mySites.guru found and reported multiple security issues in JEM (Joomla Event Manager), including an unauthenticated article overwrite. No stable fix yet.

22 Aug 2026

Other vulnerabilities in JEM - Joomla Event Manager

Updating for CVE-2026-77989 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extension.