CVE-2026-63265
Inconsistent CSRF token checks / privilege checks in various Regular Labs extension AJAX endpoints
HIGH
Extension Joomla — regularlabs.com
Source officielle
Description
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various Regular Labs extension AJAX endpoints - Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissions and trusted server-generated form configuration. Authenticated lower-privileged users or CSRF attacks could invoke lookups or mutations outside their authorization.
Sévérité
8.0
Élevée · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Score retenu : NVD
| Source | Sévérité d'origine | CVSS |
|---|---|---|
| NVD | HIGH | 8.0 (v3.1) |
Produit et versions
- Produit
- Extension Joomla — regularlabs.com
- Corrigée dans
- Non précisée
- Publiée
- 22/07/2026
- Modifiée
- 27/07/2026
- CWE
- CWE-284, CWE-352
Versions concernées
- Advanced Module Manager extension for Joomla — 1.0.0 – 11.0.1
- Articles Anywhere extension for Joomla — 1.0.0 – 18.0.2
- Articles Field extension for Joomla — 1.0.0 – 4.7.1
- Better Frontend Link extension for Joomla — 1.0.0 – 2.2.5
- Cache Cleaner extension for Joomla — 1.0.0 – 9.7.6
- CDN for Joomla extension for Joomla — 1.0.0 – 7.3.7
- Conditional Content extension for Joomla — 1.0.0 – 6.0.0
- Content Templater extension for Joomla — 1.0.0 – 13.0.0
- DB Replacer extension for Joomla — 1.0.0 – 8.2.7
- Email Protector extension for Joomla — 1.0.0 – 6.3.7
- Regular Labs Extension Manager extension for Joomla — 1.0.0 – 9.2.5
- GeoIP extension for Joomla — 1.0.0 – 6.3.8
11 autres
- IP Login extension for Joomla — 1.0.0 – 6.2.5
- Keyboard Shortcuts extension for Joomla — 1.0.0 – 3.2.5
- Modals extension for Joomla — 1.0.0 – 15.0.0
- Modules Anywhere extension for Joomla — 1.0.0 – 8.4.1
- Quick Index extension for Joomla — 1.0.0 – 4.3.6
- ReReplacer extension for Joomla — 1.0.0 – 15.0.3
- Snippets extension for Joomla — 1.0.0 – 9.3.10
- Sourcerer extension for Joomla — 1.0.0 – 12.2.8
- Tooltips extension for Joomla — 1.0.0 – 9.4.7
- Users Anywhere extension for Joomla — 1.0.0 – 1.2.7
- What? Nothing! extension for Joomla — 1.0.0 – 17.2.5
Sources
- NVD CNA Joomla CVE-2026-63265 vu
Ces informations proviennent des sources ci-dessus ; CVE Oyer n'y ajoute aucune interprétation.
Historique
- Détectée via nvd26/09/2026 09:34 UTC