EUVD-2026-47814Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Network-reachable AJAX endpoint requires low-privilege Joomla account or CSRF victim interaction; high triad is defensible given DB/cache mutation scope across 23 extensions.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
Lifecycle Timeline
4DescriptionCVE.org
Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissions and trusted server-generated form configuration. Authenticated lower-privileged users or CSRF attacks could invoke lookups or mutations outside their authorization.
AnalysisAI
Broken CSRF token enforcement across 23 Regular Labs AJAX-based Joomla extensions allows authenticated lower-privileged users to directly invoke privileged endpoints, or allows any attacker to perform those operations via a cross-site request forgery attack against an authenticated victim. The affected surface spans virtually the entire Regular Labs extension portfolio, from Advanced Module Manager through Sourcerer, covering all versions from 1.0.0 up to per-extension maximums. No public exploit or active exploitation has been confirmed; EPSS is 0.13%, consistent with the UI:R requirement that prevents mass automated attack.
Technical ContextAI
The vulnerability resides in AJAX endpoint handlers shared across 23 Joomla CMS extensions published by regularlabs.com (CPE prefix cpe:2.3:a:regularlabs.com:*_extension_for_joomla). Joomla extensions register AJAX tasks accessible at index.php?option=com_ajax&format=json, which are intended to validate a server-generated CSRF token (typically embedded in rendered forms) before processing mutations or sensitive lookups. CWE-352 (Cross-Site Request Forgery) captures the root cause: the shared Regular Labs AJAX dispatcher inconsistently enforced both CSRF token presence and component/item-level permission matching, meaning neither the anti-CSRF control nor the authorization gate was reliably applied before executing lookups or mutations.
RemediationAI
Upgrade all installed Regular Labs extensions beyond the maximum affected versions listed per extension (e.g., Advanced Module Manager above 11.0.1, Articles Anywhere above 18.0.2, and so on for each of the 23 extensions). Exact post-fix release versions are not independently confirmed in the available data - consult https://regularlabs.com/ for current release versions and changelogs. As a compensating control while patching, restrict Joomla backend access to the minimum necessary user accounts, revoke any guest or editor-level accounts that do not require backend AJAX access, and enforce a strict Content-Security-Policy and SameSite=Strict cookie attribute at the web server layer to reduce CSRF attack surface. Note that SameSite=Strict may interfere with cross-site form submissions on sites relying on third-party integrations.
We are tasked with generating a JSON analysis for CVE-2026-63280. We have the description, CVSS, CWE, EPSS, SSVC, tags,
Authentication bypass in Regular Labs Joomla extensions (Advanced Module Manager, Conditional Content, Content Templater
Stored cross-site scripting in Regular Labs Conditional Content and related Joomla extensions enables authenticated admi
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today