Regular Labs DB Replacer (com_dbreplacer) <= 8.2.7 - Broken Access Control (unauthorised database replacements)

Regular Labs DB Replacer

Affected versions: ≤ 8.2.7

Full advisory: our disclosure post

Regular Labs IP Login - Regular Labs IP Login (iplogin) <= 6.2.5 - Client-IP Spoofing and Weak Login Key Entropy (account impersonation)

Regular Labs IP Login up to and including 6.2.5. IP Login trusted forwarded client-IP headers without requiring a configured trusted proxy, so an attacker could spoof the IP used for automatic login and impersonate the mapped account (CVE-2026-64797). Persistent URL login keys were also generated with a non-cryptographic random generator with insufficient entropy, making them guessable (CVE-2026-64798). Also affected by CVE-2026-63265. Fixed in the Regular Labs security release of 22 July 2026 (7.0.0).

Affected versions: ≤ 6.2.5

Full advisory: our disclosure post

Regular Labs Extension Manager - Regular Labs Extension Manager (com_regularlabsmanager) <= 9.2.5 - Broken Access Control (unauthorised extension install/update/uninstall)

Regular Labs Extension Manager up to and including 9.2.5. Administrator routes and the install/update/uninstall processing did not consistently enforce component-management and installation permissions, so an unauthorised backend user, or a CSRF attack against a logged-in administrator, could install, update or remove Joomla extensions - which is a site takeover primitive. Also affected by CVE-2026-63265, missing CSRF tokens and permission checks on the shared Regular Labs AJAX endpoints. Fixed in the Regular Labs security release of 22 July 2026 (9.3.0). Update via Joomla Update or the Regular Labs Extension Manager.

Affected versions: ≤ 9.2.5

Full advisory: our disclosure post

Regular Labs Advanced Module Manager - Regular Labs Advanced Module Manager (com_advancedmodules) <= 11.0.1 - Broken Access Control, Stored XSS and GeoIP Rule Bypass

Regular Labs Advanced Module Manager up to and including 11.0.1, via the bundled Conditions component and the shared Regular Labs library. Conditions administration did not consistently enforce tokens and component/mapped-item permissions (CVE-2026-63280); stored condition values could execute HTML/JavaScript in administrator summaries (CVE-2026-63281); IP and GeoIP conditions trusted spoofable forwarded headers, letting a remote client bypass location-based display rules (CVE-2026-63683); and privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens or matching permissions (CVE-2026-63265). Fixed in the Regular Labs security release of 22 July 2026 (12.0.0).

Affected versions: ≤ 11.0.1

Full advisory: our disclosure post

Regular Labs Better Frontend Link - Regular Labs Better Frontend Link (mod_betterfrontendlink) <= 2.2.5 - Broken Access Control

Regular Labs Better Frontend Link up to and including 2.2.5. Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissions and trusted server-generated form configuration (CVE-2026-63265). Fixed in the Regular Labs security release of 22 July 2026 (2.2.6).

Affected versions: ≤ 2.2.5

Full advisory: our disclosure post

Regular Labs CDN - Regular Labs CDN for Joomla (cdnforjoomla) <= 7.3.7 - Path Traversal and Credential Exposure

Regular Labs CDN for Joomla up to and including 7.3.7. CDN versioning could check file paths outside the site directory, exposing local file existence and modification metadata (CVE-2026-65712). Also affected by CVE-2026-63265, missing CSRF tokens and permission checks on the shared Regular Labs AJAX endpoints. Note the related Cache Cleaner issue CVE-2026-64874, where CDN credentials were exposed in administrator request URLs, is covered by the Cache Cleaner rule. Fixed in the Regular Labs security release of 22 July 2026 (8.0.0).

Affected versions: ≤ 7.3.7

Full advisory: our disclosure post

Regular Labs Email Protector - Regular Labs Email Protector (emailprotector) <= 6.3.7 - Broken Access Control (Regular Labs AJAX endpoints)

Regular Labs Email Protector up to and including 6.3.7. Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissions and trusted server-generated form configuration, so authenticated lower-privileged users, or a CSRF attack, could invoke lookups or mutations outside their authorisation (CVE-2026-63265). Fixed in the Regular Labs security release of 22 July 2026 (6.3.8).

Affected versions: ≤ 6.3.7

Full advisory: our disclosure post

Regular Labs Quick Index - Regular Labs Quick Index (quickindex) <= 4.3.6 - Broken Access Control (Regular Labs AJAX endpoints)

Regular Labs Quick Index up to and including 4.3.6. Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissions and trusted server-generated form configuration, so authenticated lower-privileged users, or a CSRF attack, could invoke lookups or mutations outside their authorisation (CVE-2026-63265). Fixed in the Regular Labs security release of 22 July 2026 (5.0.0).

Affected versions: ≤ 4.3.6

Full advisory: our disclosure post

Regular Labs Snippets - Regular Labs Snippets (com_snippets) <= 9.3.10 - Broken Access Control and Search Index Content Disclosure

Regular Labs Snippets up to and including 9.3.10. Administrator actions, editor popups and import/export requests lacked consistent token, item-permission and input-validation checks, so unauthorised backend users or a CSRF attack could expose, create or modify extension configuration and items (CVE-2026-63684). Smart Search indexing could also store restricted content in the public search index (CVE-2026-64792), and the shared Regular Labs AJAX endpoints lacked consistent CSRF and permission checks (CVE-2026-63265). Fixed in the Regular Labs security release of 22 July 2026 (10.0.0). Note this rule matches the com_snippets component deliberately: the plugin element "snippets" is also used by the unrelated "Page Builder CK - Snippets" plugin.

Affected versions: ≤ 9.3.10

Full advisory: our disclosure post

Regular Labs Tabs & Accordions - Regular Labs Tabs & Accordions (tabsaccordions) <= 2.5.6 - Access Control and Search Index Content Disclosure

Regular Labs Tabs & Accordions up to and including 2.5.6. Smart Search indexing could render generated content using the indexing administrator identity instead of a public guest, so restricted or administrator-only content could be stored in the public search index and disclosed to visitors (CVE-2026-64792). Also affected by CVE-2026-63265, missing CSRF tokens and permission checks on the shared Regular Labs AJAX endpoints. Fixed in the Regular Labs security release of 22 July 2026 (3.0.0).

Affected versions: ≤ 2.5.6

Full advisory: our disclosure post