CVE-2026-63265

Vulnerability overview

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various Regular Labs extension AJAX endpoints - Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissions and trusted server-generated form configuration. Authenticated lower-privileged users or CSRF attacks could invoke lookups or mutations outside their authorization.

Affected product and versions

Product

regularlabs.com Advanced Module Manager extension for Joomla, Articles Anywhere extension for Joomla, Articles Field extension for Joomla

Affected versions

>= 1.0.0-11.0.1, >= 1.0.0-18.0.2, >= 1.0.0-4.7.1, >= 1.0.0-2.2.5, >= 1.0.0-9.7.6, >= 1.0.0-7.3.7, >= 1.0.0-6.0.0, >= 1.0.0-13.0.0, >= 1.0.0-8.2.7, >= 1.0.0-6.3.7, >= 1.0.0-9.2.5, >= 1.0.0-6.3.8, >= 1.0.0-6.2.5, >= 1.0.0-3.2.5, >= 1.0.0-15.0.0, >= 1.0.0-8.4.1, >= 1.0.0-4.3.6, >= 1.0.0-15.0.3, >= 1.0.0-9.3.10, >= 1.0.0-12.2.8

Fixed versions

No verified fixed-version field is available yet

Technical data

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-284, CWE-352