Joomla! com_booking component version 2.4.9 has a flaw that allows an attacker without authentication to discover registered user names, usernames, and email addresses by sending specially crafted GET requests. The vulnerability lies in the getUserData function of the customer controller and leads to the leakage of personally identifiable information, which can be leveraged for phishing or further attacks.

The affected product is Artio's Joomla! com_booking component, specifically version 2.4.9. No other versions are listed as impacted in the available data.

The CVSS score of 8.7 classifies this as a high‑severity vulnerability. Exploitation requires only that the attacker send a GET request to the component; authentication is not needed, so the vector is external via the network. EPSS data is unavailable, but the lack of KEV listing does not diminish the potential damage. Attackers can perform brute‑force enumeration over the vulnerable endpoint, potentially exposing large numbers of accounts in a short time.