Security
JEM Joomla extension flaws await stable fix
Multiple security issues in JEM, the Joomla Event Manager component, affect versions below 5.0.1, including stable 5.0.0. The most serious allows anonymous article overwrites and publication, while a stable fix is not yet available.
Research published by mySites.guru identified five CVE-assigned issues in JEM (com_jem), maintained by the JEM Community. The flaws include improper authorization, reflected and stored cross-site scripting, insufficient access control for attendee data, and an authenticated file-write issue. The advisory also describes event and venue takeover by registered users.
The highest-impact issue permits an unauthenticated visitor to overwrite and publish a Joomla article linked to an event. The source does not provide official CVSS scores; the CVE records were reserved but unpublished when the advisory appeared. It also says no working exploits were released.
- Affected: every JEM version below
5.0.1, including stable5.0.0. - Assigned identifiers:
CVE-2026-77034,CVE-2026-77035,CVE-2026-77989,CVE-2026-77990andCVE-2026-77991. - Fixed version:
5.0.1, currently available only as a release candidate.
Administrators should restrict or disable front-end event and venue editing, limit attendee-list access to event managers, and avoid deploying the release candidate on production sites. Check installed versions and apply stable 5.0.1 as soon as it is released.
Originally reported by mySites.guru.