JEM - Joomla Event Manager (com_jem) below 5.0.1 - Privileged Remote Code Execution, Unauthenticated Article Overwrite and Force-Publish, Cross-User Event and Venue Takeover, Reflected XSS and Attendee Data Disclosure
JEM (Joomla Event Manager) by the JEM Community is affected by multiple vulnerabilities confirmed live against JEM 5. The Joomla Security Strike Team assigned five CVE IDs on 22 August 2026 and published all five records on 27 August 2026: CVE-2026-77991, CVE-2026-77034, CVE-2026-77035, CVE-2026-77989 and CVE-2026-77990. Every record gives the affected range as 1.0.0 to 5.0.0. There is still no stable version to update to. The fixes exist only in a public 5.0.1 release candidate (the 5.0.1-bugfixes branch on GitHub). The newest stable release remains 5.0.0-stable, from 8 July 2026, which is affected. Confirmed issues: (1) Privileged remote code execution (CVE-2026-77991, CVSS 9.4 Critical) - the administrator source model writes dangerous file types including PHP, giving code execution to an account that already holds administrator access. (2) Unauthenticated article overwrite and force-publish (CVE-2026-77034, CVSS 6.9) - the front-end event.updateAssociatedArticle task performs no ACL check before writing a Joomla content article, so any visitor holding their own session token can republish and overwrite an article associated with an event, including publishing an unpublished one. (3) Cross-user event and venue takeover (CVE-2026-77035, CVSS 5.1) - allowEdit() trusts jform[created_by] and jform[access] from POST data, so a registered user with edit-own rights (the eventowner=1 setting or core.edit.own) can POST another user's record id together with their own id as created_by and take over that record. (4) Reflected XSS via the PDF export link (CVE-2026-77989, CVSS 5.3) - buildCurrentPdfLink copies the current request query string into the PDF button URL and pdfbutton() echoes it unescaped (attribute injection, no tags required). (5) Attendee data disclosure (CVE-2026-77990, CVSS 5.3) - any logged-in non-manager can read attendee names, usernames, registration dates and statuses for events they do not manage, including lists belonging to unpublished events. One further item found by code reading, stored XSS through unescaped category names, has no CVE. Mitigation until 5.0.1 stable ships: restrict front-end event and venue editing and the front-end attendees view to trusted users only, consider disabling front-end event submission, and review who holds administrator access on the site given the source-model file write. Update to JEM 5.0.1 or later as soon as a stable release is available. This rule flags every JEM version below 5.0.1, which matches the affected range stated in all five CVE records.
Affected versions: < 5.0.1
Full advisory: our disclosure post
