CVE-2026-63047

CVE-2026-63047: Joomla Extension - joomdonation.com - Invoice data exfiltration via incorrect ACL check in Events Booking 5.0.0-5.8.1

Vendor Joomdonation.com

Product Events Booking extension for Joomla

Weakness CWE-284

Published July 22, 2026

Last update July 23, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Joomla Extension - joomdonation.com - Invoice data exfiltration via incorrect ACL check in Events Booking 5.0.0-5.8.1 - The Joomla extension Events Booking prior version 5.0-5.8.1 did not properly verify that an actor is allowed to download invoice information.

Key dates

02Disclosure timeline

July 22, 2026 CVE published

July 23, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-63047 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/284.html AskarLabs — CWE-284 write-up Improper Access Control

Related vulnerabilities

04Related CVE

CVE-2026-64794 Joomla Extension - regularlabs.com - restricted user-data exposure in Users Anywhere and Articles Anywhere extensions CVE-2026-48956 Joomla! Core - [20260710] - Incorrect Access Control in com_modules CVE-2026-2356 User Registration & Membership <= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion CVE-2024-9503 Maintenance & Coming Soon Redirect Animation <= 2.1.3 - Missing Authorization to Settings Update CVE-2026-0748 Access bypass in Drupal 7 i18n_node translation UI