Skip to main content
mySites.guru
Free Audit
CriticalA PHP security release fixes two CVSS 9.2 flaws, and PHP 8.1 and older get no patchWhat it means for your site

Events Booking security vulnerabilities

mySites.guru tracks 3 vulnerabilities in Events Booking (com_eventbooking), covering 4 CVEs. Every connected Joomla site is checked against them on each audit.

Is my site affected?

Your site is affected if it runs Events Booking in any of these ranges:

  • from 5.0.0 up to but not including 5.8.2
  • from 5.0.0 up to but not including 5.8.1
  • before 4.9.5
Latest safe version
5.8.2 or later. No rule we check matches that release or any newer one.
What to do
Update Events Booking to 5.8.2 or later from the vendor, then confirm the installed version on the Joomla administrator's Extensions: Manage screen.
Check whether your sites are affected

Every Events Booking vulnerability we track

Newest first. CVSS is the score published in each CVE record, where it has one; the severity column is the rating our check uses.

CVEAffected versionsFixed inSeverityAdded
CVE-2026-63047CVSS 7.5from 5.0.0 up to but not including 5.8.25.8.2Medium2026-07-20
CVE-2026-58149CVSS 5.3CVE-2026-60024CVSS 9.8CVE-2026-60025CVSS 8.8from 5.0.0 up to but not including 5.8.15.8.1Critical2026-07-15
CVE-2026-58149CVSS 5.3CVE-2026-60024CVSS 9.8CVE-2026-60025CVSS 8.8before 4.9.54.9.5Critical2026-07-15

What we check for

CriticalCVE-2026-58149CVE-2026-60024CVE-2026-600252026-07-15

Events Booking (com_eventbooking) 5.x below 5.8.1 - Unauthenticated File Upload and User Enumeration (CVE-2026-58149, CVE-2026-60024, CVE-2026-60025)

Events Booking for Joomla 4/5/6 before 5.8.1 is affected by three vulnerabilities found by mySites.guru and assigned via the Joomla CNA. CVE-2026-60024: the front-end file upload endpoint was enabled by default on every install and accepted files from unauthenticated visitors. CVE-2026-60025: that same endpoint had no CSRF token check. CVE-2026-58149: a public endpoint returned any Joomla user name and email address for a supplied user ID with no ownership check, allowing an anonymous visitor to enumerate the entire user table. A matching download endpoint also served any file with an image extension back to anonymous callers, so uploaded content could be retrieved by anyone. JoomDonation fixed the three reported flaws in 5.8.0, but 5.8.0 was rebuilt and re-published under the same version number on 15 July 2026, so a site reporting 5.8.0 cannot be assumed to hold the later build, and all of the upload hardening (per-field permission checks, per-session and per-minute rate limits, folder size and file count caps, real image content validation, randomised filenames) only arrived in 5.8.1. Update to 5.8.1 or later. Joomla 3 sites are covered by a separate rule and must go to 4.9.5.

Affected versions: ≥ 5.0.0 and < 5.8.1

Full advisory: our disclosure post

CriticalCVE-2026-58149CVE-2026-60024CVE-2026-600252026-07-15

Events Booking (com_eventbooking) below 4.9.5 - Unauthenticated File Upload and User Enumeration (CVE-2026-58149, CVE-2026-60024, CVE-2026-60025)

Joomla 3 branch of Events Booking. Versions below 4.9.5 are affected by the same three vulnerabilities found by mySites.guru and assigned via the Joomla CNA: an unauthenticated front-end file upload enabled by default (CVE-2026-60024), no CSRF token on that endpoint (CVE-2026-60025), and unauthenticated user enumeration returning any user name and email address for a supplied user ID (CVE-2026-58149). JoomDonation released 4.9.5 on 15 July 2026 as the Joomla 3 fix. It is NOT published in the JoomDonation downloads area: configure a Download ID and use Joomla's own updater, or open a support ticket to request the package. Sites on the Joomla 4/5/6 line are covered by a separate rule and must go to 5.8.1.

Affected versions: < 4.9.5

Full advisory: our disclosure post

MediumCVE-2026-630472026-07-20

Events Booking (com_eventbooking) 5.x below 5.8.2 - Unauthenticated Invoice IDOR (billing data disclosure, fixed 5.8.2, CVE-2026-63047)

Events Booking for Joomla had an unauthenticated Insecure Direct Object Reference (IDOR) in the front-end invoice download. The access check only confirmed that a download code was present, not that it matched the requested registration, so an anonymous visitor could download any registrant's invoice (full name, organisation, postal address, email address and payment amount) by iterating the numeric id. Affects the current 5.x line only (5.0.0 up to and including 5.8.1); the legacy Joomla 3 line (4.9.x and below) does not have the vulnerable invoice-download code and is not affected. Fixed in 5.8.2. Note the fix was also silently backported into the 5.8.1 package before the 5.8.2 release, so a site reporting 5.8.1 cannot be assumed patched: update to 5.8.2 to be sure. Read-only disclosure (no write/RCE). Assigned CVE-2026-63047 via the Joomla CNA (published 22 July 2026, crediting Phil Taylor of mySites.guru). Discovered and disclosed by mySites.guru.

Affected versions: ≥ 5.0.0 and < 5.8.2

Full advisory: our disclosure post

Timeline

  1. 15 July 2026Check added for CVE-2026-58149, CVE-2026-60024 and CVE-2026-60025 (from 5.0.0 up to but not including 5.8.1)
  2. 15 July 2026Check added for CVE-2026-58149, CVE-2026-60024 and CVE-2026-60025 (before 4.9.5)
  3. 17 July 2026CVE-2026-58149 record published
  4. 17 July 2026CVE-2026-60024 record published
  5. 17 July 2026CVE-2026-60025 record published
  6. 20 July 2026Check added for CVE-2026-63047 (from 5.0.0 up to but not including 5.8.2)
  7. 22 July 2026CVE-2026-63047 record published

References

Each CVE page above links its official cve.org record and its NVD entry.

Events Booking vulnerability questions

Which versions of Events Booking are vulnerable?
mySites.guru tracks 3 vulnerabilities in Events Booking (com_eventbooking). A site is affected if its installed version is in any of these ranges: from 5.0.0 up to but not including 5.8.2; from 5.0.0 up to but not including 5.8.1; before 4.9.5.
What is the latest safe version of Events Booking?
5.8.2. Every vulnerability tracked here is fixed by 5.8.2, and no rule we check matches that release or any later one.
How do I check which version of Events Booking my Joomla site runs?
The installed version is listed on the Joomla administrator's Extensions: Manage screen; search it for com_eventbooking. mySites.guru reads the installed version on every audit of a connected site and checks it against these rules.

Running Events Booking on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.

This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.

CVE identifiers: CVE-2026-58149, CVE-2026-60024, CVE-2026-60025, CVE-2026-63047. Rules current as of 24 October 2026.