This advisory describes the security corrections included in JEM 5.0.1. It gives site administrators enough information to identify affected installations and take action without publishing exploit instructions.
Advisory Summary
| Product | Joomla Event Manager (JEM) |
|---|---|
| Fixed version | JEM 5.0.1; the fixes are also present in the JEM 5.1 development line. |
| Affected Joomla versions | Depends on the installed JEM release. See the affected-version range for each item below. |
| Publication date | Planned for 2026-09-14, after package and update-service verification. |
| CVE | Pending Joomla CNA coordination where applicable. Do not publish placeholder CVE identifiers. |
| Review priority | Four relative review levels are used below: Highest, High, Medium and Low. These labels order the JEM 5.0.1 disclosure and are not CVSS severity ratings. |
| CVSS 4.0 | — |
| Identified by | JEM internal security review. |
| Known exploitation | Pending final disclosure review. Do not claim that exploitation is known or unknown without evidence. |
| Solution | Update to JEM 5.0.1 or a later supported release. |
Affected Versions
The affected ranges below cover stable public releases and were checked against the corresponding historical JEM source tags.
- JEM 2.3.6–5.0.0: applies to longstanding event, attendee, registration, export, import or protected-action flows identified below.
- JEM 4.4.2–5.0.0: applies to functionality introduced by the JEM Embed, Load More or email-sharing generation.
- JEM 4.5.0–5.0.0: applies to associated-article, PDF or remote-catalog functionality introduced in that release line.
Priority Levels
These levels express the relative importance assigned during the internal JEM review. They do not replace a CVSS 4.0 assessment. The CVSS field remains empty until a vector and score are formally assigned.
| Review priority | Security references | Meaning |
|---|---|---|
| Highest | SEC-01–SEC-04 | Direct authorisation or confidential-data boundaries requiring first attention. |
| High | SEC-05–SEC-08 | Material server-network, stored-output or local-resource risks with additional prerequisites or context. |
| Medium | SEC-09 | A constrained output risk requiring a specific rendering path and user interaction. |
| Low | SEC-10 | A desktop-client risk requiring an authorised export followed by opening the generated file. |
Security Corrections
These ten corrections address direct authorisation, output, data-exposure and resource-containment risks. A blank CVSS field means that no CVSS 4.0 vector or score has yet been assigned; it must not be interpreted as a zero score. Distinct vulnerabilities should retain distinct CVE identifiers when CVE coordination is applicable.
Review priority: Highest · CVSS 4.0: — · Affected: JEM 4.5.0–5.0.0 · Fixed: JEM 5.0.1
JEM now applies the stored event and Joomla content permissions before synchronising an associated article. This prevents an authenticated request from changing related content without the required object-level authorisation.
Review priority: Highest · CVSS 4.0: — · Affected: JEM 2.3.6–5.0.0 · Fixed: JEM 5.0.1
Frontend and backend decisions now use ownership and access values loaded from the stored record. Client-submitted ownership fields are not trusted as an authorisation source.
Review priority: Highest · CVSS 4.0: — · Affected: JEM 2.3.6–5.0.0 · Fixed: JEM 5.0.1
Attendee views, print layouts and exports now enforce authorisation against the requested stored event before attendee information is returned.
Review priority: Highest · CVSS 4.0: — · Affected: JEM 2.3.6–5.0.0 · Fixed: JEM 5.0.1
Registration and cancellation now apply event visibility, publication, invitation and effective deadline rules on the server for each requested event.
Review priority: High · CVSS 4.0: — · Affected: JEM 2.3.6–5.0.0 · Fixed: JEM 5.0.1
The CSS editor is limited to validated stylesheet resources within approved locations, and reviewed category-name output is encoded consistently.
Review priority: High · CVSS 4.0: — · Affected: JEM 4.5.0–5.0.0 · Fixed: JEM 5.0.1
Remote catalogue and import downloads now reject private-network destinations, revalidate redirects, pin validated DNS destinations and apply bounded network and response limits before processing imported content.
Review priority: High · CVSS 4.0: — · Affected: JEM 2.3.6–5.0.0 · Fixed: JEM 5.0.1
Stored event author values now use validated plain-text storage and contextual output encoding at their rendering boundaries.
Review priority: High · CVSS 4.0: — · Affected: JEM 4.5.0–5.0.0 · Fixed: JEM 5.0.1
Images used by PDF output must resolve inside approved JEM/Joomla media locations and must pass the supported raster-image policy before processing.
Review priority: Medium · CVSS 4.0: — · Affected: JEM 4.5.0–5.0.0 · Fixed: JEM 5.0.1
Dynamic PDF links and related attributes now use context-appropriate output encoding.
Review priority: Low · CVSS 4.0: — · Affected: JEM 2.3.6–5.0.0 · Fixed: JEM 5.0.1
JEM applies one shared spreadsheet-control neutralisation policy to exported CSV values before they are written.
Security Hardening and Reliability
These additional changes improve preventive controls, limit abuse and make resource handling more predictable. They are documented for transparency but are not presented as separate confirmed vulnerabilities. Their CVSS fields remain empty unless a later assessment establishes otherwise.
Review priority: Medium · CVSS 4.0: — · Affected: JEM 2.3.6–5.0.0 · Fixed: JEM 5.0.1
Capacity decisions and multi-event registration updates use transactional checks to prevent overbooking races and partial series updates.
Review priority: Medium · CVSS 4.0: — · Affected: JEM 2.3.6–5.0.0 · Fixed: JEM 5.0.1
Registration quantities use strict validated limits, and image handling applies bounded dimensions and resource checks before transformation.
Review registration commit 9c795d7fc · Review image-safeguard commit 665d2d304
Review priority: Medium · CVSS 4.0: — · Affected: JEM 4.5.0–5.0.0 · Fixed: JEM 5.0.1
Frontend and administrator associated-article notifications use one consistent HTML-attribute encoding path for controller-generated links, forms and hidden values.
Review priority: Medium · CVSS 4.0: — · Affected: JEM 4.4.2–5.0.0 · Fixed: JEM 5.0.1
JEM Embed now validates a bounded request allowlist, protects configured credentials and applies guest-level visibility, request quotas and safe response behaviour.
Review priority: Medium · CVSS 4.0: — · Affected: JEM 4.4.2–5.0.0 · Fixed: JEM 5.0.1
The public Load More action now uses an explicit read-only route with validated bounded inputs, request quotas, generic errors and consistent record visibility.
Review priority: Medium · CVSS 4.0: — · Affected: JEM 2.3.6–5.0.0 · Fixed: JEM 5.0.1
Reviewed state-changing actions now require POST and Joomla CSRF validation, and session tokens are no longer placed in generated action URLs.
Review priority: Low · CVSS 4.0: — · Affected: JEM 4.4.2–5.0.0 · Fixed: JEM 5.0.1
Email sharing now validates the authenticated sender context, applies request limits and uses safe server-owned message and link handling.
Review priority: Low · CVSS 4.0: — · Affected: JEM 2.3.6–5.0.0 · Fixed: JEM 5.0.1
Import formats share bounded record, file and parser budgets, and XML-based content is processed with network access and unsafe entity handling disabled.
Impact and Recommended Action
The corrections cover authorisation, content integrity, confidential attendee data, registration consistency, output encoding, server-side request handling and resource-consumption controls. The exact impact and authentication requirements must be stated per CVE after the individual CVSS review.
- Create a complete backup of the Joomla site and database.
- Install the full JEM 5.0.1 package through Joomla's Extension Installer or Joomla Updates.
- Clear Joomla and server caches where applicable.
- Verify the installed JEM version in the JEM Control Panel.
- Review events, venues, registrations, imports, exports, modules and frontend access with the site's real permission roles.
Credits
These corrections and hardening measures were identified during the JEM internal security review. No external reporter is associated with this consolidated JEM 5.0.1 advisory.
Disclosure Timeline
| Date | Milestone |
|---|---|
| 2026-08-22 | The internal security findings and extended source review were consolidated for both maintained JEM release lines. |
| 2026-08-22 to 2026-08-26 | Security corrections and focused regression coverage were completed in the JEM 5.0.1 and JEM 5.1 development branches. |
| 2026-09-14 | Planned: verify the final package, official download and Joomla update path; then publish JEM 5.0.1 and this advisory. |
Pre-publication Checklist
- Confirm that the final JEM 5.0.1 ZIP is the package served by the official download URL.
- Test Joomla Updates from at least one affected JEM installation and confirm the installed version and file hashes.
- Insert an approved CVSS 4.0 vector and score when one is assigned; otherwise retain the blank field and do not imply a numerical severity.
- Request and insert CVE identifiers through Joomla's CNA where applicable; do not create placeholder identifiers.
- Confirm the JEM internal security review attribution and that no external reporter is associated with this advisory.
- Replace planned timeline entries with the actual release and publication times.
- Link each changelog security line to the relevant advisory anchor or CVE.
- Remove the private-draft warning only after every preceding item is complete.
This page follows the Joomla extension security-disclosure guidance: coordinated publication, transparent CVSS and CVE status, explicit affected and fixed versions, actionable administrator guidance, documented origin and a preserved timeline.