Security
Events Booking flaw exposed registrants’ invoices
A security flaw in the Joomla Events Booking extension allowed unauthenticated visitors to download other registrants’ invoices, exposing personal and payment information.
Research published by mySites.guru identifies the issue as an insecure direct object reference and authorization failure. The vulnerable release tested was 5.8.1; the vendor, JoomDonation, fixed the issue in 5.8.2. The disclosure is tracked as CVE-2026-63047.
Invoices could include a registrant’s name, organisation, postal address, email address and payment amount. The advisory says the download endpoint relied on a registration ID supplied in the request and did not properly confirm that the requester was entitled to access the document. No formal severity rating is given. mySites.guru demonstrated the problem on a clean test installation, says it did not access live sites, and released no proof of concept. It reports no known in-the-wild exploitation.
- Update Events Booking to
5.8.2on every site, including installations previously updated to5.8.1. - If an immediate update is not possible, disable the extension’s invoicing feature temporarily.
- Because invoices may contain personal data, administrators should assess whether the exposure requires further privacy or breach-response action.
Originally reported by mySites.guru.