CVE-2023-54357
Joomla com_booking 2.4.9 Information Disclosure via Account Enumeration
- State
- Published
- Severity
- 8.7 High
- Published
- Jun 19, 2026
- Updated
- Jun 23, 2026
- Reserved
- Jan 10, 2026
Description
Joomla com_booking component 2.4.9 contains an information disclosure vulnerability that allows unauthenticated attackers to enumerate user accounts by exploiting the getUserData function in the customer controller. Attackers can send GET requests to index.php with option=com_booking, controller=customer, task=getUserData, and an id parameter to retrieve user names, usernames, and email addresses through brute force enumeration.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-203 Observable Discrepancy
Affected Products
| Product | Versions |
|---|---|
Joomla! com_booking componentArtio |
|
References
- ExploitDB-51595exploit
- Official Product Homepageproduct
- Product Referenceproduct
- VulnCheck Advisory: Joomla com_booking 2.4.9 Information Disclosure via Account Enumerationthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.