This vulnerability allows any authenticated Joomla user who is not a manager to read attendee lists for events they do not manage. The exposed information includes attendee names, usernames, registration dates, and statuses, even for unpublished events. The weakness resides in improper access control, as identified by CWE-639, and permits disclosure of potentially sensitive user data and event information.

Affected is the Joomla Event Manager (JEM) extension for Joomla, provided by joomlaeventmanager.net. Versions prior to 5.0.1 are vulnerable; the extension name is Joomla Event Manager and the vendor is joomlaeventmanager.net.

The CVSS score of 5.3 places the issue in the medium severity range. No EPSS score is available, so the exact likelihood of exploitation is uncertain, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is local; the attacker merely needs to be an authenticated Joomla user without manager privileges. Once exploited, the attacker gains read-only access to attendee data for all events, which could expose personal data and enable social engineering or privacy violations. No privileged escalation or code execution is possible, but the data exposure could have privacy and compliance implications.