What’s Vulnerable › Vulnerabilities
CVE-2026-101112: Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2.4.3.4
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-29 · updated 2026-10-06
- Weakness: CWE-639
Description
Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2.4.3.4 - The public removeTmpAttachment action accepts an integer attachment ID and deletes the matching database row and file. The controller verifies a Joomla session token, but the model does not bind that ID to the session that uploaded the file, the current user, the form, the upload field, or the temporary state. Any guest can obtain a token for their own session, so the token prevents CSRF but does not authorize the target object.
Affected products
- balbooa.com Balbooa Forms extension for Joomla: before 2.4.3.4 — fixed in 2.4.3.4
How to fix
Upgrade to a fixed version: balbooa.com Balbooa Forms extension for Joomla 2.4.3.4. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-101112 or the next vulnerability affects your stack