CVE-2026-71570

The real vulnerability here isn't the ACL bypass itself — it's the architectural assumption that component-scoped permissions can safely govern access to core system resources. When a user whose account is scoped to the icagenda event management component can enumerate the entire user database, the permission model has failed at a structural level, not just an implementation level. The version range tells the story: 2.0.0 through 4.0.11, spanning multiple major Joomla releases and at least two complete code rewrites. The same flawed pattern persisted across years of development and fundamental architectural transitions. That's not a single developer oversight — that's an architectural trap that the system keeps selecting for, regardless of which developer is writing the code. For defenders, the concrete risk is user enumeration enabling credential stuffing and targeted attacks. Someone with access scoped to com_icagenda can pull every username from the database — that's not a component-level data leak, it's a system-wide targeting database exposure. The CVSS 5.1 dramatically understates the blast radius. User enumeration isn't a terminal vulnerability; it's a precision targeting system for every subsequent attack against that installation. Check whether your Joomla installation runs icagenda below version 4.0.12 and prioritize the upgrade. Beyond that, audit any third-party extension that queries core tables (users, assets, extensions) without explicit permission gating — the Joomla component model makes it easy to overlook these checks, and the pattern has recurred across CMS ecosystems for over a decade. The architectural question is whether CMS platforms can design permission models that don't require extension developers to reason about the full graph of what their code touches. The historical record suggests this may be an inherent tension in extensible systems, which means the defensive posture must assume these gaps will continue to appear and respond accordingly.

Reviewed through automated stages and approved by a human before publication.