Missing CSRF Tokens in Joomla Extension from Yootheme
CVE-2026-77029

4.6MEDIUM

Key Information:

Vendor

Yootheme.com

Status
Zoo Extension For Joomla
Vendor
CVE Published:
21 August 2026

What is CVE-2026-77029?

The Yootheme Zoo extension for Joomla is affected by a vulnerability that arises from missing Cross-Site Request Forgery (CSRF) tokens. This issue allows attackers to initiate state-changing requests on behalf of authenticated users without their consent. Proper implementation of CSRF tokens is crucial to prevent unauthorized actions and protect user data. It is recommended that users of Zoo extension versions below 4.1.66 apply available patches or upgrades to mitigate potential security risks associated with this vulnerability.

Affected Version(s)

Zoo extension for Joomla 1.0.0-4.1.65

References

https://www.yootheme.com/
product

CVSS V4

Score:
4.6
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Phil Taylor, mysites.guru
.