What is the CVSS score of CVE-2026-63685?

CVE-2026-63685 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Db Replacer Extension For Joomla CVE-2026-63685

EUVD-2026-47813 HIGH

Improper Access Control (CWE-284)

2026-07-22 Joomla

Authentication Bypass CSRF Db Replacer Extension For Joomla Regularlabs Com

8.8

CVSS 3.1 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (Joomla) · only source for this CVE.

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 27, 2026 - 19:23 vuln.today

CVSS changed

Jul 27, 2026 - 19:22 NVD

8.8 (HIGH)

CVE Published

Jul 22, 2026 - 20:43 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 22, 2026 - 20:43 cve.org

HIGH 8.8

DescriptionCVE.org

Administrator routes and replacement requests did not consistently require Super User permission and a valid token. An unauthorized backend user or CSRF attack could perform database replacements, potentially causing major data corruption or site compromise.

AnalysisAI

Database corruption or site takeover in DB Replacer extension for Joomla versions 1.0.0 through 8.2.7 allows unauthorized backend users or CSRF attacks to perform database replacements, risking major data corruption. The vulnerability arises from inconsistent enforcement of Super User permission and CSRF token validation on administrative routes and replacement requests. No public exploit has been identified at time of analysis, and EPSS estimates a low 0.2% probability of exploitation.