CVE-2026-101112
Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2.4.3.4
- State
- Published
- Severity
- 6.9 Medium
- Published
- Sep 29, 2026
- Updated
- Sep 30, 2026
- Reserved
- Sep 28, 2026
Description
Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2.4.3.4 - The public removeTmpAttachment action accepts an integer attachment ID and deletes the matching database row and file. The controller verifies a Joomla session token, but the model does not bind that ID to the session that uploaded the file, the current user, the form, the upload field, or the temporary state. Any guest can obtain a token for their own session, so the token prevents CSRF but does not authorize the target object.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N | Joomla |
Weaknesses
- CWE-639 (Authorization Bypass Through User-Controlled Key)
Affected Products
| Product | Versions |
|---|---|
Balbooa Forms extension for Joomlabalbooa.com |
|
References
- https://www.balbooa.com/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.