CVE-2026-78083 - Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Contact Endpoints in SP Property < 4.1.4 · CoreCVE

Back Back to CVE browser

HIGH

Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Contact Endpoints in SP Property < 4.1.4

Published Sep 10, 2026

7.1

HIGH

CVSS 4.0

EPSS 0.21%

Description

Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Contact Endpoints in SP Property < 4.1.4 - The visitor booking (properties.booking) and agent contact form submission (agents.sendmail) endpoints processed POST requests without verifying Joomla session anti-CSRF tokens.

Affected products

Vendor Joomshaper.com Product SP Property extension for Joomla Default
unaffected
- Version
  1.0.0-4.1.3
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

SP Property extension for Joomla

unaffected

Version	Status	Constraints
1.0.0-4.1.3	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-352

CSRF

References (2)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-75391		Advisory
https://www.joomshaper.com/joomla-extensions/sp-property		product

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner Joomla

Published Sep 10, 2026

Updated Sep 11, 2026

Reserved Aug 22, 2026

Link CVE-2026-78083

CISA Vulnrichment

Updated Sep 10, 2026

Status Deferred

Modified Sep 10, 2026

Link CVE-2026-78083

Severity n/a

Public date n/a

Links CVE-2026-78083

Assigner Joomla

Published Sep 10, 2026

Updated Sep 11, 2026

Exploited since n/a

Link EUVD-2026-75391

EUVD-2026-75391