Pre-auth Payment Amount Manipulation in Balbooa Forms by Joomla Extension

CVE-2026-67363

What is CVE-2026-67363?

The Balbooa Forms extension for Joomla is susceptible to a significant vulnerability where the stripeCharges and payAuthorize endpoints accept payment amounts from user-controlled parameters. This flaw allows unattended attackers to manipulate payment amounts, potentially allowing them to purchase items for minimal prices or alter key transaction details, such as quantities and shipping information. The lack of authentication or CSRF protections increases the severity of this issue, offering bad actors a straightforward means to exploit the payment process.

References