CVE-2023-54357 Joomla com_booking 2.4.9 Information Disclosure via Account Enumeration
Unauthenticated attackers can enumerate user accounts and retrieve personal data via brute force requests in the Joomla com_booking component.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-54357?
CVE-2023-54357 is a high-severity vulnerability in Artio Joomla! com_booking component, published on 19 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Joomla com_booking component 2.4.9 contains an information disclosure vulnerability that allows unauthenticated attackers to enumerate user accounts by exploiting the getUserData function in the customer controller. Attackers can send GET requests to index.php with option=com_booking, controller=customer, task=getUserData, and an id parameter to retrieve user names, usernames, and email addresses through brute force enumeration.
Weakness: CWE-203
Which versions are affected by CVE-2023-54357?
It affects 1 product.
Products include Artio Book It\!.
How do I fix CVE-2023-54357?
No fix has been published for CVE-2023-54357 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-54357 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-54357 exists.
Sources
Also known as GHSA-xgqm-c7vm-24xf.