Live › vulnerability › CVE-2026-103420
The StageIt Joomla extension from php-web-design.com accepts state-changing requests without verifying they came from the logged-in user. An attacker can trick a logged-in administrator's browser into performing actions on the site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 14:23 UTC. All times on this page are UTC.
Joomla sites with the commercial StageIt staging extension (php-web-design.com) below 5.8.0 on Joomla 5 or below 6.4.0 on Joomla 6. An attacker needs no account but must get a logged-in StageIt administrator to open a crafted page; the missing security token on build, push, remove, restore, backup-delete, Options-save and clear-log actions then lets that page trigger them. mySites.guru reads the changelog as also allowing PHP written to params.php through Options save (their assessment, untested, not NVD's). Sites without StageIt can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| StageIt | joomla | 1.0 - 5.7.5, 6.0 - 6.3.5 | 5.8.0, 6.4.0 |
5.8.0 (Joomla 5) or StageIt 6.x to 6.4.0 (Joomla 6); both released 24 Oct 2026 per the vendor changelog as reported by mySites.guru6.5.0 / 5.9.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Joomla Extension - php-web-design.com - CSRF for various actions in StageIt 1.0-5.7.5, 6.0-6.3.5
This page as .md · .json · in your agent: get_signal("CVE-2026-103420")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.