CVE-2026-71570CWE-284broken-access-control

CVE-2026-71570

published August 15, 2026

CVSS

5.1

EPSS

Percentile

34.3

In the wild

Unconfirmed

What it is

Joomla Extension - icagenda.com - ACL bypass allowing arbitrary user enumeration < 2.0.0-4.0.11 - A backend operator granted access scoped to `com_icagenda` only could enumerate Joomla user profiles.

The record

Technical detail

CVSS: 5.1 · NONE
CVSS v4.0: 5.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS: 0.00412 · 34.3th percentile
Weakness: CWE-284 · Improper Access Control
Published: 2026-08-15T01:17Z

References (1)

https://www.icagenda.com/ · [email protected]

EPSS history

Timeline

14 AUG 20:08Z
Joomla Extension - icagenda.com - ACL bypass allowing arbitrary user enumeration < 2.0.0-4.0.11
cvelistv5