ChangeIntel IT change radar

Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-101112

Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2.4.3.4

CVSS 4.0 6.9 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

Historical advisory recorded 23 Oct 2026 15:48:27 UTC. Read the latest advisory.

cve-program · CVE-2026-101112

Published

Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2.4.3.4 - The public removeTmpAttachment action accepts an integer attachment ID and deletes the matching database row and file. The controller verifies a Joomla session token, but the model does not bind that ID to the session that uploaded the file, the current user, the form, the upload field, or the temporary state. Any guest can obtain a token for their own session, so the token prevents CSRF but does not authorize the target object.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-101112

Published

com_baforms

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "packageName": "com_baforms",
                    "product": "Balbooa Forms extension for Joomla",
                    "vendor": "balbooa.com",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "1.0.0-2.4.3.3"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON