Events Booking (com_eventbooking) 5.x below 5.8.1 - Unauthenticated File Upload and User Enumeration (CVE-2026-58149, CVE-2026-60024, CVE-2026-60025)
Events Booking for Joomla 4/5/6 before 5.8.1 is affected by three vulnerabilities found by mySites.guru and assigned via the Joomla CNA. CVE-2026-60024: the front-end file upload endpoint was enabled by default on every install and accepted files from unauthenticated visitors. CVE-2026-60025: that same endpoint had no CSRF token check. CVE-2026-58149: a public endpoint returned any Joomla user name and email address for a supplied user ID with no ownership check, allowing an anonymous visitor to enumerate the entire user table. A matching download endpoint also served any file with an image extension back to anonymous callers, so uploaded content could be retrieved by anyone. JoomDonation fixed the three reported flaws in 5.8.0, but 5.8.0 was rebuilt and re-published under the same version number on 15 July 2026, so a site reporting 5.8.0 cannot be assumed to hold the later build, and all of the upload hardening (per-field permission checks, per-session and per-minute rate limits, folder size and file count caps, real image content validation, randomised filenames) only arrived in 5.8.1. Update to 5.8.1 or later. Joomla 3 sites are covered by a separate rule and must go to 4.9.5.
Affected versions: ≥ 5.0.0 and < 5.8.1
Full advisory: our disclosure post
Events Booking (com_eventbooking) below 4.9.5 - Unauthenticated File Upload and User Enumeration (CVE-2026-58149, CVE-2026-60024, CVE-2026-60025)
Joomla 3 branch of Events Booking. Versions below 4.9.5 are affected by the same three vulnerabilities found by mySites.guru and assigned via the Joomla CNA: an unauthenticated front-end file upload enabled by default (CVE-2026-60024), no CSRF token on that endpoint (CVE-2026-60025), and unauthenticated user enumeration returning any user name and email address for a supplied user ID (CVE-2026-58149). JoomDonation released 4.9.5 on 15 July 2026 as the Joomla 3 fix. It is NOT published in the JoomDonation downloads area: configure a Download ID and use Joomla's own updater, or open a support ticket to request the package. Sites on the Joomla 4/5/6 line are covered by a separate rule and must go to 5.8.1.
Affected versions: < 4.9.5
Full advisory: our disclosure post
Events Booking (com_eventbooking) 5.x below 5.8.2 - Unauthenticated Invoice IDOR (billing data disclosure, fixed 5.8.2, CVE-2026-63047)
Events Booking for Joomla had an unauthenticated Insecure Direct Object Reference (IDOR) in the front-end invoice download. The access check only confirmed that a download code was present, not that it matched the requested registration, so an anonymous visitor could download any registrant's invoice (full name, organisation, postal address, email address and payment amount) by iterating the numeric id. Affects the current 5.x line only (5.0.0 up to and including 5.8.1); the legacy Joomla 3 line (4.9.x and below) does not have the vulnerable invoice-download code and is not affected. Fixed in 5.8.2. Note the fix was also silently backported into the 5.8.1 package before the 5.8.2 release, so a site reporting 5.8.1 cannot be assumed patched: update to 5.8.2 to be sure. Read-only disclosure (no write/RCE). Assigned CVE-2026-63047 via the Joomla CNA (published 22 July 2026, crediting Phil Taylor of mySites.guru). Discovered and disclosed by mySites.guru.
Affected versions: ≥ 5.0.0 and < 5.8.2
Full advisory: our disclosure post
Running Events Booking on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
CVE identifiers: CVE-2026-58149, CVE-2026-60024, CVE-2026-60025, CVE-2026-63047. Rules current as of 13 September 2026.