FR
live
High CVSS 8

CVE-2026-63265

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various Regular Labs extension AJAX endpoints - Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissions and trusted server-generated form configuration. Authenticated lower-privileged users or CSRF attacks could invoke lookups or mutations outside their authorization.

What this means

Exposure
Exploitable remotely over the network and with an ordinary user account — but only if a user opens booby-trapped content.
Impact
An attacker can read sensitive data, modify or destroy data and take the service offline.
Weakness
Access control is applied incorrectly, leaving a protected resource reachable without the required rights.
Likelihood
Its EPSS score stays low: nothing points to imminent exploitation, which is no reason to leave it unpatched.

What to doFold into the next patch cycle.

Read automatically from the CVSS vector, the weakness type (CWE) and the EPSS score. The technical description above remains the one published by NIST.

Published
22 July 2026
CVSS
8 (v3.1) CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
EPSS
0.12% probability of exploitation within 30 days · above 2% of all CVEs
Weakness
CWE-284CWE-352
Sources
nvd
References

Type at least two characters.

navigate open esc dismiss