EUVD-2026-47895
GHSA-6g7r-7864-fr8w
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Primary rating from Vendor (Joomla) · only source for this CVE.
CVSS VectorVendor: Joomla
Lifecycle Timeline
4DescriptionCVE.org
The editor popup could expose restricted module data to authenticated users without the required module permissions or valid request tokens.
AnalysisAI
Insufficient permission and CSRF token checks in the Modules Anywhere editor popup for Joomla allow authenticated users to view and modify restricted module data without proper authorization. The vulnerability affects all versions up to 8.4.1. No public exploit code or active exploitation is known at this time; the EPSS exploitation probability is low.
Content tags in the Articles Anywhere and Modules Anywhere extensions for Joomla can ignore access controls, enabling un
Broken CSRF token enforcement across 23 Regular Labs AJAX-based Joomla extensions allows authenticated lower-privileged
Information disclosure in multiple Regular Labs Joomla extensions allows unauthenticated visitors to retrieve administra
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today