CVE•Published 2026-08-19•Modified 2026-08-26•0 articles on news•4 live references•NVD data

CVE-2026-67363

Vulnerability data via NVD (ingested)

CVSS v3.1

—

EPSS percentile

Exploit Prediction Scoring System · top 75% of all CVEs

Weaknesses (CWE)

CWE-472External Control of Assumed-Immutable Web Parameter CWE-602Client-Side Enforcement of Server-Side Security

Description

Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2 - The stripeCharges and payAuthorize endpoints accept the charge total from a client-controlled request parameter and forward it to the payment gateway without recomputing it from the form's configured product prices. Neither endpoint enforces authentication or CSRF checks. An unauthenticated attacker can purchase any priced item for an arbitrary amount (e.g., $0.01), and can additionally forge line items, quantities, and shipping.

Timeline

Published 2026-08-19

Modified 2026-08-26

External references

NVD MITRE Exploit-DB VulnCheck

Search for exposed instances

Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common). Live host counts are a Premium feature.

Shodan · vuln tag

vuln:CVE-2026-67363

Hosts Shodan has explicitly fingerprinted as vulnerable.

More intel sources (5)

Shodan report

vuln:CVE-2026-67363

Country / ASN / product breakdown for the vuln query.

Censys

vulnerabilities.cve_id: CVE-2026-67363

Censys host search filtered to this CVE id.

grep.app

CVE-2026-67363