This summer, I conducted an in-depth analysis and audit of the iCagenda extension, which included reducing entry points, strengthening input validation, and fixing an Ajax-based SQL injection vulnerability in the calendar module—following an external report by Joep van Antwerpen (Onvio) on 13 August 2026, which was confirmed by the developer (yours truly) on 14 August.
On 14 August 2026 I released iCagenda 4.0.12 to fix those multiple security issues, from low-medium to critical. On the same day, I released version 3.9.16 to fix vulnerabilities in iCagenda installations on Joomla 3 sites.
The Ajax-based SQL injection vulnerability (issue #0) was responsibly reported by Joep van Antwerpen (Onvio).
I thank Joep for responsibly reporting this issue and helping me improve the security of iCagenda.
All users running an affected version should update immediately.
What are the vulnerabilities?
We deliberately choose not to publish functional proofs of concept. The goal of this article is to inform the public so that they can update as soon as possible, rather than to provide a method for attackers.
- Vulnerability #0 alone justifies an immediate update if you have any version from 4.0.0 to 4.0.11 installed on your Joomla site. As the vulnerability lies in the new calendar module introduced in version 4.0.0, previous versions and iCagenda installations on Joomla 3 are not affected by this critical vulnerability.
- Vulnerability #1 is significant but more limited in scope: there is no account compromise, no cross-user data exposure, and no privileged/admin action involved — the profile is unauthorized-but-self-scoped state change plus a griefing/spam vector, not identity theft or takeover.
- Exploiting vulnerabilities #2 and #3 requires an authenticated backend account with access to `com_icagenda` — it has no impact on an unauthenticated visitor, and none on an install where every backend account is a Super User.
Security Advisory
Issue #0: Unauthenticated SQL injection
Severity: Critical
Probability: High
CVE Number: CVE-2026-67365
Versions affected: Versions 4.0.0 through 4.0.11 are affected.
Solution: Upgrade to version 4.0.12 or later
Reported By: Joep van Antwerpen of Onvio
| Joomla version | Joomla 3 | Joomla 4 | Joomla 5 | Joomla 6 |
|---|---|---|---|---|
| iCagenda versions affected | none | 4.0.0-4.0.11 | 4.0.0-4.0.11 | 4.0.0-4.0.11 |
| Unauthenticated SQL injection via mod_icagenda_calendar / com_ajax | no | yes | yes | yes |
Issue #1: CSRF
Severity: Medium
Probability: Moderate
CVE Number: CVE-2026-67366
Versions affected: Versions 2.0.0 through 4.0.11 are affected.
Solution: Upgrade to version 4.0.12 or later (on Joomla 3, upgrade to 3.9.16 or later)
| Joomla version | Joomla 3 | Joomla 4 | Joomla 5 | Joomla 6 |
|---|---|---|---|---|
| iCagenda versions affected | 2.0.0-3.9.15 | 3.8.0-4.0.11 | 3.9.0-4.0.11 | 4.0.0-4.0.11 |
| CSRF on frontend registration actions | yes | yes | yes | yes |
Issue #2: ACL bypass (admin only)
Severity: Medium
Probability: Low
CVE Number: CVE-2026-71570
Versions affected: Versions 3.6.0 through 4.0.11 are affected.
Solution: Upgrade to version 4.0.12 or later (on Joomla 3, upgrade to 3.9.16 or later)
| Joomla version | Joomla 3 | Joomla 4 | Joomla 5 | Joomla 6 |
|---|---|---|---|---|
| iCagenda versions affected | 3.6.0-3.9.15 | 3.8.0-4.0.11 | 3.9.0-4.0.11 | 4.0.0-4.0.11 |
| ACL bypass allowing arbitrary Joomla user enumeration | yes | yes | yes | yes |
Issue #3: SQL injection (admin only)
Severity: Medium-high
Probability: Moderate
CVE Numver: CVE-2026-71571
Versions affected: Versions 3.0.0 through 4.0.11 are affected.
Solution: Upgrade to version 4.0.12 or later (on Joomla 3, upgrade to 3.9.16 or later)
| Joomla version | Joomla 3 | Joomla 4 | Joomla 5 | Joomla 6 |
|---|---|---|---|---|
| iCagenda versions affected | 3.0.0-3.9.15 | 3.8.0-4.0.11 | 3.9.0-4.0.11 | 4.0.0-4.0.11 |
| CSRF on frontend registration actions | yes | yes | yes | yes |
If you don't have updated yet, please update right now!
The version 4.0.12 is for Joomla 4 up to latest Joomla 6 version.
On 14 August 2026, I released version 3.9.16 to fix the security issues #1 to #3, on Joomla 3 websites. iCagenda versions for Joomla 3 are not affected by the critical security issue in the new iCagenda 4 Calendar module.
Note: iCagenda 4.x does not support Joomla 3, and iCagenda 3.9 (Joomla 3.10) will only receive security patches until 13 October 2026.
If you have any questions please post on the forum or open a new support ticket if you own an active Pro Subscription.