CVE-2026-63684
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
Multiple Regular Labs extensions for Joomla did not consistently check CSRF tokens, item permissions, or input validation in admin actions, editor popups, and import/export operations. Unauthorized backend users or CSRF attacks could expose, create, or modify extension configuration and items.
Risk Assessment
An attacker could unauthorizedly read or change sensitive extension settings, potentially leading to data leakage or privilege escalation.
Recommendation
Update all Regular Labs extensions to the latest versions containing security fixes.
Other vulnerabilities in Regular Labs extensions
See all- CVE-2026-64795Medium
XSS vectors in tag-provided inputs in various Regular Labs extensions for Joomla allow tag-provided custom HTML, module content/title overrides and decoded modal or tooltip values to execute unsafe markup. A content author could inject JavaScript that ran in visitors’ browsers.
- CVE-2026-64792High
Multiple Regular Labs extensions for Joomla! disclose restricted content via the Smart Search index: indexing can render generated content using the indexing administrator's identity instead of a public guest, causing restricted or administrator-only content to be stored in the public search index.
- CVE-2026-63265High
AJAX endpoints in various Regular Labs extensions for Joomla did not consistently require valid CSRF tokens, matching component/item permissions, or trusted server-generated form configuration. Authenticated lower-privileged users or CSRF attacks could invoke lookups or mutations outside their authorization.
Original NVD description (English source)
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various admin/import/export actions of multiple Regular Labs extension - Administrator actions, editor popups and import/export requests lacked consistent token, item-permission and input-validation checks. Unauthorized backend users or CSRF attacks could expose, create or modify extension configuration and items.