CVE-2026-64792
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Multiple Regular Labs extensions for Joomla! disclose restricted content via the Smart Search index: indexing can render generated content using the indexing administrator's identity instead of a public guest, causing restricted or administrator-only content to be stored in the public search index.
Risk Assessment
Website visitors can access administrator-only or restricted content, leading to leakage of sensitive information.
Recommendation
Update all Regular Labs extensions to the latest versions and disable Smart Search indexing for sensitive content.
Other vulnerabilities in Regular Labs extensions
See all- CVE-2026-64795Medium
XSS vectors in tag-provided inputs in various Regular Labs extensions for Joomla allow tag-provided custom HTML, module content/title overrides and decoded modal or tooltip values to execute unsafe markup. A content author could inject JavaScript that ran in visitors’ browsers.
- CVE-2026-63684High
Multiple Regular Labs extensions for Joomla did not consistently check CSRF tokens, item permissions, or input validation in admin actions, editor popups, and import/export operations. Unauthorized backend users or CSRF attacks could expose, create, or modify extension configuration and items.
- CVE-2026-63265High
AJAX endpoints in various Regular Labs extensions for Joomla did not consistently require valid CSRF tokens, matching component/item permissions, or trusted server-generated form configuration. Authenticated lower-privileged users or CSRF attacks could invoke lookups or mutations outside their authorization.
Original NVD description (English source)
Joomla Extension - regularlabs.com - disclosure of restricted content via search index in various Regular Labs extensions - Smart Search indexing could render generated content using the indexing administrator’s identity instead of a public guest. Restricted or administrator-only content could consequently be stored in the public search index and disclosed to visitors.