The Balbooa Forms extension for Joomla allows any web user to delete attachments by calling the removeTmpAttachment action with a token and an attachment id. The action validates a Joomla session token to prevent CSRF, but it does not verify that the attachment belongs to the user’s session, form, or upload field. Consequently, a guest user can obtain a token for their own session and delete any attachment belonging to other users, leading to unauthorized data loss.

The vulnerability exists in Balbooa Forms extension for Joomla versions earlier than 2.4.3.4. Any site running the extension below that version is impacted, regardless of other Joomla configuration settings.

The CVSS score of 6.9 indicates moderate severity. EPSS is not available, so the exploitation probability is unclear; the vulnerability is not listed in CISA KEV. The attack requires only a valid session token, which a guest can trivially obtain, and the attacker must craft a request with the target attachment ID. No authentication or user privileges are needed, making the exploitation straightforward for a malicious actor.