The Event Gallery extension for Joomla includes a Google Photos picker that loads image thumbnails by making HTTP requests from the Joomla server using the site’s OAuth access token. The server takes the URL to fetch directly from a request parameter without validating it and does not require a form token. As a result, an adversary can trick the server into sending the access token to any address or to internal addresses behind the server, all while acting as an authenticated administrator. Administrators with the "Manage" permission can trigger the picker on their own, allowing them to direct the server to contact arbitrary hosts. The OAuth token is valid for roughly an hour and provides the same level of access as the picker session.

All installations of the svenbluege.de Event Gallery extension for Joomla with version numbers less than 6.6.0 that have the Google Photos picker enabled. The vulnerability can be triggered by a back‑end administrator or any authenticated user who can invoke the picker interface.

The CVSS score of 6.3 indicates a medium severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, implying that the likelihood of real‑world exploitation is unknown. The attack requires an attacker to deliver a crafted page that causes the Joomla server to request an arbitrary URL, which is achievable through a web browser or simple automated script. Because the OAuth token remains valid for about an hour, the potential exposure window is limited but still significant. Implementing mitigations promptly reduces the risk considerably.