Riskcovery

CVE-2026-63265

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various Regular Labs extension AJAX endpoints

State
Published
Severity
8.0 High
Published
Jul 22, 2026
Updated
Jul 28, 2026
Reserved
Jul 16, 2026

Read the record on cve.org

Description

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various Regular Labs extension AJAX endpoints - Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissions and trusted server-generated form configuration. Authenticated lower-privileged users or CSRF attacks could invoke lookups or mutations outside their authorization.

Scores

CVSSScoreVectorSource
3.18.0 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:HCISA-ADP

Weaknesses

  • CWE-352 Cross-Site Request Forgery (CSRF)
  • CWE-284 Improper Access Control

Affected Products

ProductVersions
Advanced Module Manager extension for Joomlaregularlabs.com
  • 1.0.0-11.0.1Affected
Articles Anywhere extension for Joomlaregularlabs.com
  • 1.0.0-18.0.2Affected
Articles Field extension for Joomlaregularlabs.com
  • 1.0.0-4.7.1Affected
Better Frontend Link extension for Joomlaregularlabs.com
  • 1.0.0-2.2.5Affected
Cache Cleaner extension for Joomlaregularlabs.com
  • 1.0.0-9.7.6Affected
CDN for Joomla extension for Joomlaregularlabs.com
  • 1.0.0-7.3.7Affected
Conditional Content extension for Joomlaregularlabs.com
  • 1.0.0-6.0.0Affected
Content Templater extension for Joomlaregularlabs.com
  • 1.0.0-13.0.0Affected
DB Replacer extension for Joomlaregularlabs.com
  • 1.0.0-8.2.7Affected
Email Protector extension for Joomlaregularlabs.com
  • 1.0.0-6.3.7Affected
Regular Labs Extension Manager extension for Joomlaregularlabs.com
  • 1.0.0-9.2.5Affected
GeoIP extension for Joomlaregularlabs.com
  • 1.0.0-6.3.8Affected
IP Login extension for Joomlaregularlabs.com
  • 1.0.0-6.2.5Affected
Keyboard Shortcuts extension for Joomlaregularlabs.com
  • 1.0.0-3.2.5Affected
Modals extension for Joomlaregularlabs.com
  • 1.0.0-15.0.0Affected
Modules Anywhere extension for Joomlaregularlabs.com
  • 1.0.0-8.4.1Affected
Quick Index extension for Joomlaregularlabs.com
  • 1.0.0-4.3.6Affected
ReReplacer extension for Joomlaregularlabs.com
  • 1.0.0-15.0.3Affected
Snippets extension for Joomlaregularlabs.com
  • 1.0.0-9.3.10Affected
Sourcerer extension for Joomlaregularlabs.com
  • 1.0.0-12.2.8Affected
Tooltips extension for Joomlaregularlabs.com
  • 1.0.0-9.4.7Affected
Users Anywhere extension for Joomlaregularlabs.com
  • 1.0.0-1.2.7Affected
What? Nothing! extension for Joomlaregularlabs.com
  • 1.0.0-17.2.5Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.