CVE-2026-12133

Name of the Vulnerable Software and Affected Versions JoomSport – for Sports: Team & League, Football, Hockey & more versions prior to 5.7.9

Description An authorization flaw exists in the joomsport season groupdel() AJAX handler. The system fails to perform a capability check, verifying only a nonce before executing a DELETE query on group IDs provided by the user. This allows authenticated users with Subscriber-level access or higher to delete arbitrary JoomSport group records.

Recommendations Update to a version newer than 5.7.8. As a temporary mitigation, restrict access to the joomsport season groupdel() AJAX handler for users with Subscriber-level permissions.