iCagenda Calendar module for Joomla: unauthenticated SQL injection via com_ajax needs no session, token or account (CVE-2026-67365, CVSS 9.2) — and the vulnerable module's own version number does not track the package version

iCagenda Calendar module for Joomla: unauthenticated SQL injection via com_ajax needs no session, token or account (CVE-2026-67365, CVSS 9.2) — and the vulnerable module's own version number does not track the package version

The Joomla project's CNA published CVE-2026-67365 on 2026-08-14: an unauthenticated SQL injection (CWE-89) in mod_icagenda_calendar, the Calendar module bundled with the iCagenda events extension, reachable via com_ajax — Joomla's generic anonymous front-end AJAX entry point — with no session, token or account required. Rated CVSS 4.0 9.2 Critical (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H): "Joomla Extension - icagenda.com - Unauthenticated SQL injection in iCagenda < 4.0.0-4.0.11 - Unauthenticated SQL injection in mod_icagenda_calendar (iCagenda), reachable via com_ajax with no session, token or account" (Joomla CNA record, quoted by mySites.guru, 2026-08-17). Affected 4.0.0–4.0.11; fixed in 4.0.12. The flaw was reported by Joep van Antwerpen of Onvio, not mySites.guru's own find.

The operationally important detail is a version-tracking trap: the vulnerable Calendar module's own version number stayed pinned at 4.0.7 through package releases 4.0.8, 4.0.9, 4.0.10 and 4.0.11, and only advanced to 4.0.12 with the fix — "The Calendar module stayed at 4.0.7 through the 4.0.8, 4.0.9, 4.0.10 and 4.0.11 releases and only moved with 4.0.12, so the module version and the package version disagree and a site can look patched when it is not." (mySites.guru, 2026-08-17). A naive version check against the package number — in either direction — gives a wrong answer for this specific component. A second, independent detection trap sits upstream of that: at the time of mySites.guru's writing, iCagenda's own update feed had not yet been updated to list 4.0.12, even though the fixed release was already shipping and installing on real sites — "the feed still lists 4.0.11 from this date and nothing above it, even though 4.0.12 is shipping and installing on real sites. A site running an update check is told it is current" (mySites.guru, 2026-08-17), meaning an automated update-status check could report a vulnerable site as current independent of the module-version trap above. No vendor advisory or changelog entry exists for this fix beyond the CVE record itself at time of writing. This is the second security issue in iCagenda in two months and unrelated to the first: CVE-2026-48939, an unauthenticated file-upload flaw already CISA-KEV-listed, was fixed in 4.0.8/3.9.15 and does not cover this SQL injection.

Triage: hunt and inventory tooling should key on the Calendar module's own reported version, not the iCagenda package version, when assessing exposure to this specific CVE. On the wire, unauthenticated com_ajax requests targeting the iCagenda calendar component carrying SQL-metacharacter payloads in parameters are the delivery shape; iCagenda's legitimate calendar AJAX traffic carries only structured date/view parameters, so a request with SQL syntax in those fields has no benign explanation.