Summary
CVE-2026-67365 is an unauthenticated SQL injection vulnerability in the iCagenda extension for Joomla, specifically in the mod_icagenda_calendar module. The flaw is reachable through Joomla’s com_ajax interface without any session, CSRF token, or authenticated account, and carries a critical CVSS score of 9.2.
Technical details
- Root cause: improper neutralization of special elements in SQL statements (CWE-89) within the
mod_icagenda_calendarmodule’s handling of input. - Trigger conditions: an attacker sends a crafted request to the
com_ajaxendpoint that routes to the vulnerable module handler; no login, session cookie, or anti-CSRF token is required. - Attack vector: network-based, low attack complexity, requires some attack requirements (AT:P) but no privileges (PR:N) and no user interaction (UI:N).
- Impact: successful exploitation can lead to unauthorized reading, and potentially modification, of backend database contents, with downstream effects on confidentiality, integrity, and availability of the affected Joomla site.
Affected software
- iCagenda extension for Joomla, versions 4.0.0 through 4.0.11 (inclusive).
Severity
- CVSS v4.0 Base Score: 9.2 (Critical)
- Vector:
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H
Mitigation and recommended actions
- Immediate: Check with the vendor (icagenda.com) for a release beyond 4.0.11 that addresses this issue and upgrade as soon as it is available; at the time of publication no patched version number had been confirmed in public vendor changelogs.
- If no patch is yet available: restrict or disable public access to the
com_ajaxendpoint for the iCagenda component/module where feasible, disable or remove themod_icagenda_calendarmodule if not in active use, and deploy a web application firewall rule to block SQL injection patterns targetingcom_ajaxrequests referencing iCagenda. - Monitor web server and database logs for anomalous
com_ajax-routed requests and unexpected SQL errors as an indicator of exploitation attempts.

