What is the CVSS score of CVE-2026-63280?

CVE-2026-63280 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Advanced Module Manager Extension For Joomla CVE-2026-63280

EUVD-2026-47812 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-07-22 Joomla

CSRF Advanced Module Manager Extension For Joomla Conditional Content Extension For Joomla Content Templater Pro Extension For Joomla Rereplacer Extension Pro For Joomla Regularlabs Com

8.8

CVSS 3.1 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (Joomla) · only source for this CVE.

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 27, 2026 - 23:35 vuln.today

CVSS changed

Jul 27, 2026 - 19:22 NVD

8.8 (HIGH)

CVE Published

Jul 22, 2026 - 20:43 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 22, 2026 - 20:43 cve.org

HIGH 8.8

DescriptionCVE.org

Conditions administration did not consistently enforce tokens and component/mapped-item permissions.

AnalysisAI

We are tasked with generating a JSON analysis for CVE-2026-63280. We have the description, CVSS, CWE, EPSS, SSVC, tags, affected products, references. Need to synthesize all.

Let's break down the input:

CVE: CVE-2026-63280
Description: "Conditions administration did not consistently enforce tokens and component/mapped-item permissions."
CVSS: 8.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE: CWE-352 (Cross-Site Request Forgery)
EPSS: 0.13% (percentile 3%)
Reported by: Joomla
CPE: multiple from regularlabs.com for extensions (Advanced Module Manager, Conditional Content, Content Templater Pro, Rereplacer Pro) for Joomla.
Tags: CSRF, and the extension names.
SSVC: Exploitation: none, Automatable: no, Technical Impact: total
ENISA EUVD-ID: EUVD-2026-47812
Affected versions from EUVD: listed for each extension.
References: [cveorg] (None) https://regularlabs.com/ ... maybe missing advisory? Only link to vendor homepage. No specific advisory. So patch status unclear.

We need to produce a comprehensive analysis.

First, product_name: The vulnerability affects multiple extensions from Regular Labs for Joomla. The primary affected product is a set of extensions, but we need to pick a concise name. Could be "Regular Labs Joomla extensions" or the specific one? Since it's multiple, maybe "Advanced Module Manager" or one of them. Description: "Conditions administration did not consistently enforce tokens and component/mapped-item permissions." That sounds like CSRF and permission issues in the admin interface of these extensions. From tags: CSRF. So likely a CSRF vulnerability in all these extensions. The CWE is CWE-352, consistent.

Product name: I'll pick "Regular Labs Joomla Extensions" but that might be 3 words. Alternatively, the primary extension mentioned first in tags: "Advanced Module Manager Extension For Joomla" but that's many words. I'll go with "Regular Labs Extensions" (2 words) or "Regular Labs for Joomla"? The instruction