The vulnerability originates in the Joomla extension Event Gallery from svenbluege.de, where the backend list actions—such as setting the default payment method, shipping method, image type, order status, watermark, adding or removing an event from the shop, selecting the main image, toggling image visibility, and sorting event images—lack proper form‑token validation. An attacker can craft a malicious page that an authenticated administrator visits, causing those actions to execute automatically. While no sensitive data can be read or deleted, the attacker can alter configuration flags and order status, potentially disrupting the site’s operation.

Affected systems are Joomla installations that use the Event Gallery extension version 6.5 or earlier (i.e., any release prior to 6.6.0). This includes all sites running the unpatched Joomla extensions from svenbluege.de, as the CVE only applies to versions less than 6.6.0. No other vendors or products are listed.

The CVSS score of 5.1 places the vulnerability in the medium range, and the EPSS is not available, suggesting a moderate yet not negligible likelihood of exploitation. Since the design flaw is a straightforward CSRF lacking a token, a well‑aimed HTML page can trigger backend requests with the victim’s session cookie. This simple attack vector requires no special conditions beyond the victim’s authentication, making exploitation relatively easy. The flaw is not listed in CISA KEV, indicating it has not yet been widely exploited. The impact remains limited to configuration changes and does not allow code execution or data exfiltration.