CVE-2026-67363

Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2 - The stripeCharges and payAuthorize endpoints accept the charge total from a client-controlled request parameter and forward it to the payment gateway without recomputing it from the form's configured product prices. Neither endpoint enforces authentication or CSRF checks. An unauthenticated attacker can purchase any priced item for an arbitrary amount (e.g., $0.01), and can additionally forge line items, quantities, and shipping.

CVSS

No CVSS.

References

Link	Resource
https://www.balbooa.com/

Configurations

No configuration.

History

23 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Extensión de Joomla - balbooa.com - Manipulación del monto de pago pre-autenticación en Balbooa Forms anterior a 2.4.3.2. Los endpoints stripeCharges y payAuthorize aceptan el total del cargo de un parámetro de solicitud controlado por el cliente y lo reenvían a la pasarela de pago sin recalcularlo a partir de los precios de los productos configurados del formulario. Ninguno de los endpoints aplica comprobaciones de autenticación o CSRF. Un atacante no autenticado puede comprar cualquier artículo con precio por un monto arbitrario (p. ej., $0.01), y puede además falsificar partidas, cantidades y envío.

Information

Published : 2026-08-19 13:17

Updated : 2026-10-23 22:10

NVD link : CVE-2026-67363

Mitre link : CVE-2026-67363

CVE.ORG link : CVE-2026-67363

JSON object : View

Products Affected

No product.

CWE

CWE-472

External Control of Assumed-Immutable Web Parameter

CWE-602

Client-Side Enforcement of Server-Side Security

{"id": "CVE-2026-67363", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-67363", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-20T15:30:44.427788Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security@joomla.org", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security@joomla.org", "affectedData": [{"vendor": "balbooa.com", "product": "Balbooa Forms extension for Joomla", "versions": [{"status": "affected", "version": "1.0.0-2.4.3.1"}], "packageName": "com_baforms", "defaultStatus": "unaffected"}]}], "published": "2026-08-19T13:17:50.820", "references": [{"url": "https://www.balbooa.com/", "source": "security@joomla.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@joomla.org", "description": [{"lang": "en", "value": "CWE-472"}, {"lang": "en", "value": "CWE-602"}]}], "descriptions": [{"lang": "en", "value": "Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2 - The stripeCharges and payAuthorize endpoints accept the charge total from a client-controlled request parameter and forward it to the payment gateway without recomputing it from the form's configured product prices. Neither endpoint enforces authentication or CSRF checks. An unauthenticated attacker can purchase any priced item for an arbitrary amount (e.g., $0.01), and can additionally forge line items, quantities, and shipping."}, {"lang": "es", "value": "Extensi\u00f3n de Joomla - balbooa.com - Manipulaci\u00f3n del monto de pago pre-autenticaci\u00f3n en Balbooa Forms anterior a 2.4.3.2. Los endpoints stripeCharges y payAuthorize aceptan el total del cargo de un par\u00e1metro de solicitud controlado por el cliente y lo reenv\u00edan a la pasarela de pago sin recalcularlo a partir de los precios de los productos configurados del formulario. Ninguno de los endpoints aplica comprobaciones de autenticaci\u00f3n o CSRF. Un atacante no autenticado puede comprar cualquier art\u00edculo con precio por un monto arbitrario (p. ej., $0.01), y puede adem\u00e1s falsificar partidas, cantidades y env\u00edo."}], "lastModified": "2026-10-23T22:10:00.160", "sourceIdentifier": "security@joomla.org"}