EUVD-2026-47894
GHSA-88mr-69pq-px7w
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V3 - Web Frontend Security Cache-Control for sensitive pages
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 28, 2026
Information disclosure in Regular Labs Articles Anywhere and Users Anywhere extensions for Joomla allows unauthenticated remote attackers to view content that should be expired or unpublished. Date-sensitive query caching generates cache keys lacking a bounded time component, so results cached during a valid period persist and can be served after content becomes unavailable. No active exploitation or public proof-of-concept has been identified, and EPSS indicates a low probability of widespread exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Articles Anywhere Extension For Joomla gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (Joomla) · only source for this CVE.
CVSS VectorVendor: Joomla
Lifecycle Timeline
3DescriptionCVE.org
Date-sensitive query cache keys did not retain a bounded time component. Cached results could remain active across future publication or expiry boundaries, potentially exposing content after it should become unavailable.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Content tags in the Articles Anywhere and Modules Anywhere extensions for Joomla can ignore access controls, enabling un
Code injection in Regular Labs Sourcerer before 17.0.1, when used with Articles Anywhere before 20.1.1, allows an authen
Broken CSRF token enforcement across 23 Regular Labs AJAX-based Joomla extensions allows authenticated lower-privileged
Information disclosure in multiple Regular Labs Joomla extensions allows unauthenticated visitors to retrieve administra
Information disclosure in Regular Labs Joomla extensions (Users Anywhere and Articles Anywhere) allows authenticated use
Exploit-DB