CVE-2026-65757

HighCVSS 8.1

Published: 23/07/2026(UTC)Updated: 24/10/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

8th percentile - higher than 8% of all known CVEs

Summary

The Joomla Extension Modules Anywhere from regularlabs.com has inconsistent CSRF token checks and privilege checks. The editor popup could expose restricted module data to authenticated users without the required module permissions or valid request tokens.

Risk Assessment

Authenticated users may access module data they should not have access to, potentially leading to information disclosure.

Recommendation

Update the Modules Anywhere extension to the latest version available from regularlabs.com.

Other vulnerabilities in Modules Anywhere

CVE-2026-100750High
Joomla Extension regularlabs.com Modules Anywhere versions 1.5.0 - 9.0.5 for Joomla is vulnerable to LFI / SSRF. Modules Anywhere Pro lets additional attributes on a module tag replace arbitrary parameters of the selected module. The overrides are applied without checking who authored the content containing the tag. The security effect depends on how the selected module consumes the replaced parameter; Joomla's core Feed module opens the rssurl parameter server-side and accepts local file: URLs as well as network URLs.

Original NVD description (English source)

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules Anywhere extension - The editor popup could expose restricted module data to authenticated users without the required module permissions or valid request tokens.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS