What the vulnerability does
01Description
Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2 - The stripeCharges and payAuthorize endpoints accept the charge total from a client-controlled request parameter and forward it to the payment gateway without recomputing it from the form's configured product prices. Neither endpoint enforces authentication or CSRF checks. An unauthenticated attacker can purchase any priced item for an arbitrary amount (e.g., $0.01), and can additionally forge line items, quantities, and shipping.
Explanation of Vulnerability in Simple Terms
02Summary
The Balbooa Forms extension for Joomla contains a parameter manipulation vulnerability that allows attackers to modify form data in transit. An attacker can intercept and alter web parameters that the extension assumes are immutable, potentially changing form submissions or bypassing intended restrictions. This affects versions 1.0.0 through 2.4.3.1. Site administrators should update to a patched version when available.
What an attacker can do
03Attacker Capabilities
Modify form parameters to alter form submissions or bypass form validation rules.
Potential impact on your site
04Site Impact
Form data integrity compromised; attackers can submit altered form data without authorization.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
August 19, 2026
CVE published
August 21, 2026
Record updated
