Regular Labs Extension Manager Extension For Joomla
Monthly
We need to produce a JSON object with all fields as plain-text strings. Input: CVE-2026-63265. Description: Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissions and trusted server-generated form configuration. Authenticated lower-privileged users or CSRF attacks could invoke lookups or mutations outside their authorization. CVSS score 8.0, vector: AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, CWE-352. EPSS 0.13% (percentile 3%). Reported by: Joomla (probably the vendor). CPE list: many extensions for Joomla. Tags list includes many extension names. SSVC: Exploitation: none, Automatable: no, Technical Impact: total. ENISA EUVD affected versions list for many extensions. References: regularlabs.com and vuldb.com. We must synthesize into a comprehensive analysis. Fields: - product_name: "1-3 words ONLY. The specific product or service name affected." Since it's multiple extensions, but the core issue is Regular Labs extensions for Joomla. I'll pick "Regular Labs Joomla Extensions" (1-3 words, "Regular Labs Joomla Extensions" is 3 words, fine. Could also say "Regular Labs for Joomla" but better to be specific. Description mentions "Privileged Regular Labs AJAX endpoints" so it's across many Regular Labs extensions. So product_name: "Regular Labs Joomla Extensions". This covers the vendor and platform. - summary: 2-3 sentence plain-language. Don't copy description. Original synthesis. Mention what vulnerability, affected product, what attacker can do, if actively exploited, POC, EPSS risk. This is a CSRF vulnerability allowing authenticated lower-privileged users or CSRF attacks to perform unauthorized actions. Starts with impact: "Cross-site request forgery (CSRF) in Regular Labs Joomla extensions allows authenticated lower-privileged users or CSRF attacks to invoke unauthorized AJAX lookups and mutations." Then "Affected extensions (e.g., Advanced Module Manager, Articles Anywhere, etc.) fail to consistent
Insufficient access controls in Regular Labs Extension Manager for Joomla (versions 1.0.0–9.2.5) allow an unauthenticated attacker via CSRF or a low-privilege backend user to install, update, or remove extensions. Successful exploitation can lead to complete site compromise through the installation of a malicious extension. EPSS probability is low (0.13%) and no active exploitation or public exploit code has been identified.
We need to produce a JSON object with all fields as plain-text strings. Input: CVE-2026-63265. Description: Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissions and trusted server-generated form configuration. Authenticated lower-privileged users or CSRF attacks could invoke lookups or mutations outside their authorization. CVSS score 8.0, vector: AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, CWE-352. EPSS 0.13% (percentile 3%). Reported by: Joomla (probably the vendor). CPE list: many extensions for Joomla. Tags list includes many extension names. SSVC: Exploitation: none, Automatable: no, Technical Impact: total. ENISA EUVD affected versions list for many extensions. References: regularlabs.com and vuldb.com. We must synthesize into a comprehensive analysis. Fields: - product_name: "1-3 words ONLY. The specific product or service name affected." Since it's multiple extensions, but the core issue is Regular Labs extensions for Joomla. I'll pick "Regular Labs Joomla Extensions" (1-3 words, "Regular Labs Joomla Extensions" is 3 words, fine. Could also say "Regular Labs for Joomla" but better to be specific. Description mentions "Privileged Regular Labs AJAX endpoints" so it's across many Regular Labs extensions. So product_name: "Regular Labs Joomla Extensions". This covers the vendor and platform. - summary: 2-3 sentence plain-language. Don't copy description. Original synthesis. Mention what vulnerability, affected product, what attacker can do, if actively exploited, POC, EPSS risk. This is a CSRF vulnerability allowing authenticated lower-privileged users or CSRF attacks to perform unauthorized actions. Starts with impact: "Cross-site request forgery (CSRF) in Regular Labs Joomla extensions allows authenticated lower-privileged users or CSRF attacks to invoke unauthorized AJAX lookups and mutations." Then "Affected extensions (e.g., Advanced Module Manager, Articles Anywhere, etc.) fail to consistent
Insufficient access controls in Regular Labs Extension Manager for Joomla (versions 1.0.0–9.2.5) allow an unauthenticated attacker via CSRF or a low-privilege backend user to install, update, or remove extensions. Successful exploitation can lead to complete site compromise through the installation of a malicious extension. EPSS probability is low (0.13%) and no active exploitation or public exploit code has been identified.