# JEM - Joomla Event Manager (com_jem) below 5.0.1 - Privileged Remote Code Execution, Unauthenticated Article Overwrite and Force-Publish, Cross-User Event and Venue Takeover, Reflected XSS and Attendee Data Disclosure

[Joomla Vulnerability Database](https://mysites.guru/vulnerabilities/)/CVE-2026-77991

CVE-2026-77991CriticalCVSS 9.4CVE published 27 August 2026Added to mySites.guru 27 August 2026

# JEM - Joomla Event Manager (com\_jem) below 5.0.1 - Privileged Remote Code Execution, Unauthenticated Article Overwrite and Force-Publish, Cross-User Event and Venue Takeover, Reflected XSS and Attendee Data Disclosure

JEM (Joomla Event Manager) by the JEM Community is affected by multiple vulnerabilities confirmed live against JEM 5. The Joomla Security Strike Team assigned five CVE IDs on 22 August 2026 and published all five records on 27 August 2026: CVE-2026-77991, CVE-2026-77034, CVE-2026-77035, CVE-2026-77989 and CVE-2026-77990. Every record gives the affected range as 1.0.0 to 5.0.0. There is still no stable version to update to. The fixes exist only in a public 5.0.1 release candidate (the 5.0.1-bugfixes branch on GitHub). The newest stable release remains 5.0.0-stable, from 8 July 2026, which is affected. Confirmed issues: (1) Privileged remote code execution (CVE-2026-77991, CVSS 9.4 Critical) - the administrator source model writes dangerous file types including PHP, giving code execution to an account that already holds administrator access. (2) Unauthenticated article overwrite and force-publish (CVE-2026-77034, CVSS 6.9) - the front-end event.updateAssociatedArticle task performs no ACL check before writing a Joomla content article, so any visitor holding their own session token can republish and overwrite an article associated with an event, including publishing an unpublished one. (3) Cross-user event and venue takeover (CVE-2026-77035, CVSS 5.1) - allowEdit() trusts jform\[created\_by\] and jform\[access\] from POST data, so a registered user with edit-own rights (the eventowner=1 setting or core.edit.own) can POST another user's record id together with their own id as created\_by and take over that record. (4) Reflected XSS via the PDF export link (CVE-2026-77989, CVSS 5.3) - buildCurrentPdfLink copies the current request query string into the PDF button URL and pdfbutton() echoes it unescaped (attribute injection, no tags required). (5) Attendee data disclosure (CVE-2026-77990, CVSS 5.3) - any logged-in non-manager can read attendee names, usernames, registration dates and statuses for events they do not manage, including lists belonging to unpublished events. One further item found by code reading, stored XSS through unescaped category names, has no CVE. Mitigation until 5.0.1 stable ships: restrict front-end event and venue editing and the front-end attendees view to trusted users only, consider disabling front-end event submission, and review who holds administrator access on the site given the source-model file write. Update to JEM 5.0.1 or later as soon as a stable release is available. This rule flags every JEM version below 5.0.1, which matches the affected range stated in all five CVE records.

Copy citation

## Is my site affected?

- **Affected** - JEM - Joomla Event Manager before 5.0.1
- **Fixed in** - 5.0.1
- **What to do** - Update JEM - Joomla Event Manager to 5.0.1 or later.

[Check whether your sites are affected](https://mysites.guru/free-audit/)

## How CVE-2026-77991 is scored

The base metrics as Joomla CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.

9.4 Critical

CVSS 4.0, scored by Joomla CNA

`CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`

### How it is reached

- **AV:N Attack vector** - Network. Reachable across the internet
- **AC:L Attack complexity** - Low. Nothing to work around, it just works
- **AT:N Attack requirements** - None. Works against any affected install
- **PR:H Privileges required** - High. Needs an account with elevated rights
- **UI:N User interaction** - None. Nobody has to be tricked into anything

### What it does to the site

- **VC:H Confidentiality** - High. Everything the site holds can be read
- **VI:H Integrity** - High. Data and files can be altered at will
- **VA:H Availability** - High. The site can be taken down

### What it does beyond the site

- **SC:H Confidentiality** - High. Data on other systems can be read
- **SI:H Integrity** - High. Other systems can be altered
- **SA:H Availability** - High. Other systems can be taken down

## Timeline

1.  22 August 2026[We published: Five Security Issues in JEM (Joomla Event Manager), and No Stable Fix Yet](https://mysites.guru/blog/jem-joomla-event-manager-disclosure/)
2.  27 August 2026CVE-2026-77991 record published by its CNA
3.  27 August 2026mySites.guru check added for JEM - Joomla Event Manager (before 5.0.1)

## Rule details

Critical[CVE-2026-77034](https://mysites.guru/vulnerabilities/CVE-2026-77034/)[CVE-2026-77035](https://mysites.guru/vulnerabilities/CVE-2026-77035/)[CVE-2026-77989](https://mysites.guru/vulnerabilities/CVE-2026-77989/)[CVE-2026-77990](https://mysites.guru/vulnerabilities/CVE-2026-77990/)[CVE-2026-77991](https://mysites.guru/vulnerabilities/CVE-2026-77991/)2026-08-27

[JEM - Joomla Event Manager](https://mysites.guru/vulnerabilities/jem/)

Affected versions: < 5.0.1

Full advisory: [our disclosure post](https://mysites.guru/blog/jem-joomla-event-manager-disclosure/)

## Our disclosure post

[![Five Security Issues in JEM (Joomla Event Manager), and No Stable Fix Yet](https://mysites.guru/_astro/jem-joomla-event-manager-disclosure.BOwBKof3_21Xypr.webp)

### Five Security Issues in JEM (Joomla Event Manager), and No Stable Fix Yet

mySites.guru found and reported multiple security issues in JEM (Joomla Event Manager), including an unauthenticated article overwrite. No stable fix yet.

22 Aug 2026

](https://mysites.guru/blog/jem-joomla-event-manager-disclosure/)

## Other vulnerabilities in JEM - Joomla Event Manager

Updating for CVE-2026-77991 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extension.

### [JEM - Joomla Event Manager](https://mysites.guru/vulnerabilities/jem/)

Latest safe version: 5.0.1

-   [CVE-2026-77034](https://mysites.guru/vulnerabilities/CVE-2026-77034/) Critical, before 5.0.1
-   [CVE-2026-77035](https://mysites.guru/vulnerabilities/CVE-2026-77035/) Critical, before 5.0.1
-   [CVE-2026-77989](https://mysites.guru/vulnerabilities/CVE-2026-77989/) Critical, before 5.0.1
-   [CVE-2026-77990](https://mysites.guru/vulnerabilities/CVE-2026-77990/) Critical, before 5.0.1

## References

-   [CVE-2026-77991 on cve.org (the official CVE record)](https://www.cve.org/CVERecord?id=CVE-2026-77991)
-   [CVE-2026-77991 in the NIST National Vulnerability Database](https://nvd.nist.gov/vuln/detail/CVE-2026-77991)
-   [Five Security Issues in JEM (Joomla Event Manager), and No Stable Fix Yet](https://mysites.guru/blog/jem-joomla-event-manager-disclosure/)

## CVE-2026-77991 questions

Show all

Which versions are affected by CVE-2026-77991?

[CVE-2026-77991](https://mysites.guru/vulnerabilities/CVE-2026-77991/) affects JEM - Joomla Event Manager before 5.0.1. The fix is in 5.0.1.

How do I fix CVE-2026-77991?

Update JEM - Joomla Event Manager to 5.0.1 or later. Then confirm the installed version on the Joomla administrator's Extensions: Manage screen.

How severe is CVE-2026-77991?

Joomla CNA scores it 9.4 (Critical) under CVSS 4.0. In plain terms: reachable across the internet, needs an account with elevated rights and nobody has to be tricked into anything.

## Running an affected version on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, [fix.mysites.guru](https://fix.mysites.guru/) is a single fixed fee per incident, usually resolved the same day.

This check is part of the [mySites.guru Joomla vulnerability scanner](https://mysites.guru/joomla-vulnerability-scanner/), which reads every installed extension's version on each audit. Browse the rest of the [Joomla vulnerability database](https://mysites.guru/vulnerabilities/).

Rules current as of 14 October 2026.