{"id":"CVE-2026-103420","kind":"vulnerability","aliases":["CVE-2026-103420"],"related":[],"title":"Joomla StageIt extension: cross-site request forgery on various actions","description":"Joomla Extension - php-web-design.com - CSRF for various actions in StageIt 1.0-5.7.5, 6.0-6.3.5","summary":"The StageIt Joomla extension from php-web-design.com accepts state-changing requests without verifying they came from the logged-in user. An attacker can trick a logged-in administrator's browser into performing actions on the site.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"StageIt","fixed":["5.8.0","6.4.0"],"affected":"1.0 - 5.7.5, 6.0 - 6.3.5","ecosystem":"joomla"}],"ecosystems":[],"tags":["csrf","joomla","joomla-extension","php","runtime","stageit"],"not_affected_if":["extension-not-installed","stageit-5.8.0-or-later","stageit-6.4.0-or-later"],"how_to_check":"- In Joomla admin, Extensions > Manage, find StageIt and note its version.\n- Affected: StageIt 5.x below 5.8.0 and 6.x below 6.4.0 (NVD lists 1.0-5.7.5 and 6.0-6.3.5).\n- Also check StageIt 4.x and older (Joomla 3/4): NVD's range covers them, but no fixed version was confirmed for them in the sources I read; JED lists 4.2.1 and 2.2.1 as current.\n- After updating, review /stgbackups/ and the StageIt log for pushes, restores or deletes nobody on your team ran.","fix":"Update StageIt 5.x to 5.8.0 (Joomla 5) or StageIt 6.x to 6.4.0 (Joomla 6); both released 24 Oct 2026 per the vendor changelog as reported by mySites.guru. Current JED listing shows 6.5.0 / 5.9.0.","status":"open","published_at":"2026-11-02T14:17:34+00:00","first_seen_at":"2026-11-02T14:23:23+00:00","triaged_at":"2026-11-02T14:24:51+00:00","updated_at":"2026-11-02T14:26:35+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-02T14:24:51Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Joomla StageIt extension: cross-site request forgery on various actions","impact":"medium","summary":"The StageIt Joomla extension from php-web-design.com accepts state-changing requests without verifying they came from the logged-in user. An attacker can trick a logged-in administrator's browser into performing actions on the site.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["joomla","php","stageit"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker performs unauthorized actions as a logged-in user via forged requests","analyst_note":"Check the NVD entry and the vendor's advisory for the affected actions, required privileges, and the fixed version.","how_to_check":"- Check whether the StageIt extension is installed in Joomla under Extensions > Manage and note its version.\n- Compare the installed version against the affected ranges 1.0-5.7.5 and 6.0-6.3.5.","plain_action":"","needs_analyst":true,"not_affected_if":["extension-not-installed"],"who_is_affected":"Sites running the StageIt extension for Joomla in the listed version ranges. The sources do not say which actions are affected or whether logged-out visitors can reach them, so exposure beyond the installed version is unknown.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00066,"input_tokens":4087,"output_tokens":503,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the vendor's advisory for the affected actions, required privileges, and the fixed version.","search":"'-103420':14A,17A '-2026':13A,16A '1.0':74C '5.7.5':75C '6.0':76C '6.3.5':77C 'accept':33B 'action':11A,61B,71C 'administr':56B 'attack':49B 'browser':58B 'came':41B 'chang':36B 'cross':5A 'cross-sit':4A 'csrf':19B,68C 'cve':12A,15A 'extens':3A,23B,30B,66C 'forgeri':8A 'joomla':1A,20B,22B,29B,65C 'joomla-extens':21B 'log':45B,54B 'logged-in':44B,53B 'perform':60B 'php':24B 'php-web-design.com':32B,67C 'request':7A,37B 'runtim':25B 'site':6A,64B 'stageit':2A,18A,26B,28B,73C 'state':35B 'state-chang':34B 'trick':51B 'user':47B 'various':10A,70C 'verifi':39B 'without':38B","nicknames":[],"mitigations":[],"who_affected":"Joomla sites with the commercial StageIt staging extension (php-web-design.com) below 5.8.0 on Joomla 5 or below 6.4.0 on Joomla 6. An attacker needs no account but must get a logged-in StageIt administrator to open a crafted page; the missing security token on build, push, remove, restore, backup-delete, Options-save and clear-log actions then lets that page trigger them. mySites.guru reads the changelog as also allowing PHP written to params.php through Options save (their assessment, untested, not NVD's). Sites without StageIt can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["stageit"],"ptokens":["stageit"],"labels":["csrf","high","joomla","joomlaextension","php","runtime","stageit"],"first_public_at":"2026-11-02T14:17:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@joomla.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103420","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103420","severity":null,"published_at":"2026-11-02T14:17:34+00:00","modified_at":"2026-11-02T14:17:34+00:00","first_seen_at":"2026-11-02T14:23:23+00:00","fetched_at":"2026-11-02T14:23:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-103420:1376","url":null,"severity":null,"published_at":"2026-11-02T14:26:35+00:00","modified_at":"2026-11-02T14:26:35+00:00","first_seen_at":"2026-11-02T14:26:35+00:00","fetched_at":"2026-11-02T14:26:35+00:00","note":"NVD page had no text; ranges from CVE title. Fix versions and action list from mySites.guru reading of vendor changelog (secondary); vendor changelog page fetched did not show 5.8.0/6.4.0, so nothing marked verified. Older lines (<=4.x) fix status unknown."}],"documents":[{"id":52291,"url":"https://mysites.guru/blog/stageit-5-8-0-6-4-0-security-release/","title":"StageIt 5.8.0 and 6.4.0 fix CSRF on every action (mySites.guru)","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":52298,"url":"https://extensions.joomla.org/extension/stageit/","title":"StageIt, Joomla Extension Directory","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}