CVE-2026-76610 MEDIUM

CVE-2026-76610: Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo < 4.1.65

Vendor Yootheme.com
Product Zoo extension for Joomla
Weakness CWE-352 · CSRF
Published August 20, 2026
Last update August 21, 2026
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo < 4.1.65 - The comment controller endpoint lacked ACL checks, allowing unauthorized tag modifications by unauthenticated users.

Explanation of Vulnerability in Simple Terms

02Summary

The Zoo extension for Joomla contains a cross-site request forgery (CSRF) vulnerability that allows an attacker to perform unauthorized actions on behalf of an authenticated user. An attacker can craft a malicious link or page that, when visited by a logged-in site administrator, executes unwanted changes to the site. No user interaction beyond visiting a page is required from the attacker's perspective, but the victim must be logged in.

What an attacker can do

03Attacker Capabilities

Perform unauthorized actions on the site by tricking a logged-in user into visiting a malicious page.

Potential impact on your site

04Site Impact

An attacker can modify site settings or data by exploiting a logged-in administrator's session without their knowledge.

Conditions required to exploit

05Prerequisites

Victim must be logged into Joomla and visit an attacker-controlled page or click a malicious link.

Key dates

06Disclosure timeline

August 20, 2026 CVE published
August 21, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-63265 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various Regular Labs extension AJAX endpoints CVE-2026-9731 Wp Js Detect <= 1.0.9 - Cross-Site Request Forgery to Plugin Settings Update CVE-2026-15988 AI Engine <= 3.6.5 - Cross-Site Request Forgery to Privilege Escalation via REQUEST_URI Substring Match CVE-2026-24537 WordPress WP Accessibility Helper (WAH) plugin <= 0.6.6 - Cross Site Request Forgery (CSRF) vulnerability CVE-2026-57751 WordPress Heateor Social Login plugin <= 1.1.39 - Cross Site Request Forgery (CSRF) vulnerability