CVE-2026-101112
Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2.4.3.4
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2.4.3.4 - The public removeTmpAttachment action accepts an integer attachment ID and deletes the matching database row and file. The controller verifies a Joomla session token, but the model does not bind that ID to the session that uploaded the file, the current user, the form, the upload field, or the temporary state. Any guest can obtain a token for their own session, so the token prevents CSRF but does not authorize the target object.
| CWE | CWE-639 |
| Vendor | balbooa.com |
| Product | balbooa forms extension for joomla |
| Published | Sep 29, 2026 |
Stay Ahead of the Next One
Get instant alerts for balbooa.com balbooa forms extension for joomla
Be the first to know when new unknown vulnerabilities affecting balbooa.com balbooa forms extension for joomla are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
balbooa.com / Balbooa Forms extension for Joomla
1.0.0-2.4.3.3
Credits
Sergiy Tryzhychynskyi