Regular Labs Joomla Extensions CVE-2026-85188

Exploitation requires an authenticated session with high-privilege (administrator-level) access to the Joomla backend, specifically the ability to use the Conditions editor feature present in at least one of the four affected Regular Labs extensions. The attacker must be able to send a crafted HTTP POST/GET request to the Conditions editor endpoint specifying arbitrary table and column names. The Joomla installation must have at least one of the affected extensions installed and active in a version below the fixed thresholds. Exploitation is limited by the PR:H requirement: unauthenticated users and low-privilege subscribers or registered users cannot reach the vulnerable endpoint. Non-default conditions include having one of the four specific extensions installed; a vanilla Joomla installation without these extensions is unaffected.

The CVSS 4.0 score of 6.9 with vector AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N correctly reflects the principal risk constraint: exploitation requires high-privilege (administrative) access to the Joomla backend. Despite the high confidentiality impact on the vulnerable system, the PR:H metric substantially limits real-world exposure - an external unauthenticated attacker cannot directly exploit this flaw. The absence of KEV listing, no public POC, and no reported active exploitation further reduce urgency. The 'SQLi' tag in the input data is misleading and contradicted directly by the CVE description, which states 'This is an authorization failure rather than SQL injection'; that tag should not influence triage. Even a mid-sized municipal IT team in kalisz running Joomla with these extensions should treat this as a medium-priority patch rather than an emergency response, given that the exploitation path is gated behind admin authentication. The primary real-world risk scenario is an insider threat or a compromised admin account leveraging this to exfiltrate database contents beyond what the admin UI would normally expose.

An attacker who holds or has compromised a Joomla administrator account on an affected installation navigates to the Conditions editor in one of the Regular Labs extensions and submits a crafted HTTP request specifying an arbitrary database table name and column name - for example, the Joomla users table and its password hash column. The backend executes a SQL query against that unintended table and returns the field value as part of the Condition Set name, disclosing sensitive data to the attacker within the admin UI response. No public proof-of-concept exists at time of analysis, but the attack requires only knowledge of the Joomla database schema, which is publicly documented.