# Regular Labs DB Replacer (com_dbreplacer) <= 8.2.7 - Broken Access Control (unauthorised database replacements) [Joomla Vulnerability Database](https://mysites.guru/vulnerabilities/)/CVE-2026-63265 CVE-2026-63265HighCVSS 8.0CVE published 22 July 2026Added to mySites.guru 22 July 2026 # Regular Labs DB Replacer (com\_dbreplacer) <= 8.2.7 - Broken Access Control (unauthorised database replacements) Regular Labs DB Replacer up to and including 8.2.7. Administrator routes and replacement requests did not consistently require Super User permission and a valid token, so an unauthorised backend user or a CSRF attack could run database replacements across the site - potentially causing major data corruption or full site compromise. Also affected by CVE-2026-63265, missing CSRF tokens and permission checks on the shared Regular Labs AJAX endpoints. Fixed in the Regular Labs security release of 22 July 2026 (9.0.0). Copy citation ## Is my site affected? CVE-2026-63265 is checked by 10 rules. Find the extension and release line your site runs: Extension Affected versions Fixed in What to do Regular Labs DB Replacer up to and including 8.2.7 after 8.2.7 Update Regular Labs DB Replacer to the newest release from the vendor. This flaw covers versions up to 8.2.7, so any later release is outside it. Regular Labs IP Login up to and including 6.2.5 after 6.2.5 Update Regular Labs IP Login to the newest release from the vendor. This flaw covers versions up to 6.2.5, so any later release is outside it. Regular Labs Extension Manager up to and including 9.2.5 after 9.2.5 Update Regular Labs Extension Manager to the newest release from the vendor. This flaw covers versions up to 9.2.5, so any later release is outside it. [Snippets](https://mysites.guru/vulnerabilities/snippets/) up to and including 9.3.10 after 9.3.10 Update Snippets to the newest release from the vendor. This flaw covers versions up to 9.3.10, so any later release is outside it. [Tabs & Accordions](https://mysites.guru/vulnerabilities/tabsaccordions/) up to and including 2.5.6 after 2.5.6 Update Tabs & Accordions to the newest release from the vendor. This flaw covers versions up to 2.5.6, so any later release is outside it. [Advanced Module Manager](https://mysites.guru/vulnerabilities/advancedmodules/) up to and including 11.0.1 after 11.0.1 Update Advanced Module Manager to the newest release from the vendor. This flaw covers versions up to 11.0.1, so any later release is outside it. [Quick Index](https://mysites.guru/vulnerabilities/quickindex/) up to and including 4.3.6 after 4.3.6 Update Quick Index to the newest release from the vendor. This flaw covers versions up to 4.3.6, so any later release is outside it. Regular Labs Better Frontend Link up to and including 2.2.5 after 2.2.5 Update Regular Labs Better Frontend Link to the newest release from the vendor. This flaw covers versions up to 2.2.5, so any later release is outside it. Regular Labs CDN up to and including 7.3.7 after 7.3.7 Update Regular Labs CDN to the newest release from the vendor. This flaw covers versions up to 7.3.7, so any later release is outside it. Regular Labs Email Protector up to and including 6.3.7 after 6.3.7 Update Regular Labs Email Protector to the newest release from the vendor. This flaw covers versions up to 6.3.7, so any later release is outside it. [Check whether your sites are affected](https://mysites.guru/free-audit/) ## How CVE-2026-63265 is scored The base metrics as CISA-ADP published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw. 8.0 High CVSS 3.1, scored by CISA-ADP `CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H` ### How it is reached - **AV:N Attack vector** - Network. Reachable across the internet - **AC:L Attack complexity** - Low. Nothing to work around, it just works - **PR:L Privileges required** - Low. Any logged-in account will do - **UI:R User interaction** - Required. Someone has to click or visit something - **S:U Scope** - Unchanged. Contained to the extension it is in ### What it does - **C:H Confidentiality** - High. Everything the site holds can be read - **I:H Integrity** - High. Data and files can be altered at will - **A:H Availability** - High. The site can be taken down ## Timeline 1. 22 July 2026CVE-2026-63265 record published by its CNA 2. 22 July 2026mySites.guru check added for Regular Labs DB Replacer (up to and including 8.2.7) 3. 22 July 2026mySites.guru check added for Regular Labs IP Login (up to and including 6.2.5) 4. 22 July 2026mySites.guru check added for Regular Labs Extension Manager (up to and including 9.2.5) 5. 22 July 2026mySites.guru check added for Snippets (up to and including 9.3.10) 6. 22 July 2026mySites.guru check added for Tabs & Accordions (up to and including 2.5.6) 7. 22 July 2026mySites.guru check added for Advanced Module Manager (up to and including 11.0.1) 8. 22 July 2026mySites.guru check added for Quick Index (up to and including 4.3.6) 9. 22 July 2026mySites.guru check added for Regular Labs Better Frontend Link (up to and including 2.2.5) 10. 22 July 2026mySites.guru check added for Regular Labs CDN (up to and including 7.3.7) 11. 22 July 2026mySites.guru check added for Regular Labs Email Protector (up to and including 6.3.7) 12. 22 July 2026[We published: Regular Labs Patched Its Whole Joomla Extension Catalogue at Once](https://mysites.guru/blog/regular-labs-joomla-extension-security-release/) ## Rule details High[CVE-2026-63685](https://mysites.guru/vulnerabilities/CVE-2026-63685/)[CVE-2026-63265](https://mysites.guru/vulnerabilities/CVE-2026-63265/)2026-07-22 Regular Labs DB Replacer Affected versions: ≤ 8.2.7 Full advisory: [our disclosure post](https://mysites.guru/blog/regular-labs-joomla-extension-security-release/) High[CVE-2026-64797](https://mysites.guru/vulnerabilities/CVE-2026-64797/)[CVE-2026-64798](https://mysites.guru/vulnerabilities/CVE-2026-64798/)[CVE-2026-63265](https://mysites.guru/vulnerabilities/CVE-2026-63265/)2026-07-22 Regular Labs IP Login - Regular Labs IP Login (iplogin) <= 6.2.5 - Client-IP Spoofing and Weak Login Key Entropy (account impersonation) Regular Labs IP Login up to and including 6.2.5. IP Login trusted forwarded client-IP headers without requiring a configured trusted proxy, so an attacker could spoof the IP used for automatic login and impersonate the mapped account (CVE-2026-64797). Persistent URL login keys were also generated with a non-cryptographic random generator with insufficient entropy, making them guessable (CVE-2026-64798). Also affected by CVE-2026-63265. Fixed in the Regular Labs security release of 22 July 2026 (7.0.0). Affected versions: ≤ 6.2.5 Full advisory: [our disclosure post](https://mysites.guru/blog/regular-labs-joomla-extension-security-release/) High[CVE-2026-64791](https://mysites.guru/vulnerabilities/CVE-2026-64791/)[CVE-2026-63265](https://mysites.guru/vulnerabilities/CVE-2026-63265/)2026-07-22 Regular Labs Extension Manager - Regular Labs Extension Manager (com\_regularlabsmanager) <= 9.2.5 - Broken Access Control (unauthorised extension install/update/uninstall) Regular Labs Extension Manager up to and including 9.2.5. Administrator routes and the install/update/uninstall processing did not consistently enforce component-management and installation permissions, so an unauthorised backend user, or a CSRF attack against a logged-in administrator, could install, update or remove Joomla extensions - which is a site takeover primitive. Also affected by CVE-2026-63265, missing CSRF tokens and permission checks on the shared Regular Labs AJAX endpoints. Fixed in the Regular Labs security release of 22 July 2026 (9.3.0). Update via Joomla Update or the Regular Labs Extension Manager. Affected versions: ≤ 9.2.5 Full advisory: [our disclosure post](https://mysites.guru/blog/regular-labs-joomla-extension-security-release/) Medium[CVE-2026-63684](https://mysites.guru/vulnerabilities/CVE-2026-63684/)[CVE-2026-64792](https://mysites.guru/vulnerabilities/CVE-2026-64792/)[CVE-2026-63265](https://mysites.guru/vulnerabilities/CVE-2026-63265/)2026-07-22 [Snippets](https://mysites.guru/vulnerabilities/snippets/) - Regular Labs Snippets (com\_snippets) <= 9.3.10 - Broken Access Control and Search Index Content Disclosure Regular Labs Snippets up to and including 9.3.10. Administrator actions, editor popups and import/export requests lacked consistent token, item-permission and input-validation checks, so unauthorised backend users or a CSRF attack could expose, create or modify extension configuration and items (CVE-2026-63684). Smart Search indexing could also store restricted content in the public search index (CVE-2026-64792), and the shared Regular Labs AJAX endpoints lacked consistent CSRF and permission checks (CVE-2026-63265). Fixed in the Regular Labs security release of 22 July 2026 (10.0.0). Note this rule matches the com\_snippets component deliberately: the plugin element "snippets" is also used by the unrelated "Page Builder CK - Snippets" plugin. Affected versions: ≤ 9.3.10 Full advisory: [our disclosure post](https://mysites.guru/blog/regular-labs-joomla-extension-security-release/) Medium[CVE-2026-64792](https://mysites.guru/vulnerabilities/CVE-2026-64792/)[CVE-2026-63265](https://mysites.guru/vulnerabilities/CVE-2026-63265/)2026-07-22 [Tabs & Accordions](https://mysites.guru/vulnerabilities/tabsaccordions/) - Regular Labs Tabs & Accordions (tabsaccordions) <= 2.5.6 - Access Control and Search Index Content Disclosure Regular Labs Tabs & Accordions up to and including 2.5.6. Smart Search indexing could render generated content using the indexing administrator identity instead of a public guest, so restricted or administrator-only content could be stored in the public search index and disclosed to visitors (CVE-2026-64792). Also affected by CVE-2026-63265, missing CSRF tokens and permission checks on the shared Regular Labs AJAX endpoints. Fixed in the Regular Labs security release of 22 July 2026 (3.0.0). Affected versions: ≤ 2.5.6 Full advisory: [our disclosure post](https://mysites.guru/blog/regular-labs-joomla-extension-security-release/) Medium[CVE-2026-63280](https://mysites.guru/vulnerabilities/CVE-2026-63280/)[CVE-2026-63281](https://mysites.guru/vulnerabilities/CVE-2026-63281/)[CVE-2026-63683](https://mysites.guru/vulnerabilities/CVE-2026-63683/)[CVE-2026-63265](https://mysites.guru/vulnerabilities/CVE-2026-63265/)2026-07-22 [Advanced Module Manager](https://mysites.guru/vulnerabilities/advancedmodules/) - Regular Labs Advanced Module Manager (com\_advancedmodules) <= 11.0.1 - Broken Access Control, Stored XSS and GeoIP Rule Bypass Regular Labs Advanced Module Manager up to and including 11.0.1, via the bundled Conditions component and the shared Regular Labs library. Conditions administration did not consistently enforce tokens and component/mapped-item permissions (CVE-2026-63280); stored condition values could execute HTML/JavaScript in administrator summaries (CVE-2026-63281); IP and GeoIP conditions trusted spoofable forwarded headers, letting a remote client bypass location-based display rules (CVE-2026-63683); and privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens or matching permissions (CVE-2026-63265). Fixed in the Regular Labs security release of 22 July 2026 (12.0.0). Affected versions: ≤ 11.0.1 Full advisory: [our disclosure post](https://mysites.guru/blog/regular-labs-joomla-extension-security-release/) Medium[CVE-2026-63265](https://mysites.guru/vulnerabilities/CVE-2026-63265/)2026-07-22 [Quick Index](https://mysites.guru/vulnerabilities/quickindex/) - Regular Labs Quick Index (quickindex) <= 4.3.6 - Broken Access Control (Regular Labs AJAX endpoints) Regular Labs Quick Index up to and including 4.3.6. Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissions and trusted server-generated form configuration, so authenticated lower-privileged users, or a CSRF attack, could invoke lookups or mutations outside their authorisation (CVE-2026-63265). Fixed in the Regular Labs security release of 22 July 2026 (5.0.0). Affected versions: ≤ 4.3.6 Full advisory: [our disclosure post](https://mysites.guru/blog/regular-labs-joomla-extension-security-release/) Medium[CVE-2026-63265](https://mysites.guru/vulnerabilities/CVE-2026-63265/)2026-07-22 Regular Labs Better Frontend Link - Regular Labs Better Frontend Link (mod\_betterfrontendlink) <= 2.2.5 - Broken Access Control Regular Labs Better Frontend Link up to and including 2.2.5. Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissions and trusted server-generated form configuration (CVE-2026-63265). Fixed in the Regular Labs security release of 22 July 2026 (2.2.6). Affected versions: ≤ 2.2.5 Full advisory: [our disclosure post](https://mysites.guru/blog/regular-labs-joomla-extension-security-release/) Medium[CVE-2026-65712](https://mysites.guru/vulnerabilities/CVE-2026-65712/)[CVE-2026-63265](https://mysites.guru/vulnerabilities/CVE-2026-63265/)2026-07-22 Regular Labs CDN - Regular Labs CDN for Joomla (cdnforjoomla) <= 7.3.7 - Path Traversal and Credential Exposure Regular Labs CDN for Joomla up to and including 7.3.7. CDN versioning could check file paths outside the site directory, exposing local file existence and modification metadata (CVE-2026-65712). Also affected by CVE-2026-63265, missing CSRF tokens and permission checks on the shared Regular Labs AJAX endpoints. Note the related Cache Cleaner issue CVE-2026-64874, where CDN credentials were exposed in administrator request URLs, is covered by the Cache Cleaner rule. Fixed in the Regular Labs security release of 22 July 2026 (8.0.0). Affected versions: ≤ 7.3.7 Full advisory: [our disclosure post](https://mysites.guru/blog/regular-labs-joomla-extension-security-release/) Medium[CVE-2026-63265](https://mysites.guru/vulnerabilities/CVE-2026-63265/)2026-07-22 Regular Labs Email Protector - Regular Labs Email Protector (emailprotector) <= 6.3.7 - Broken Access Control (Regular Labs AJAX endpoints) Regular Labs Email Protector up to and including 6.3.7. Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissions and trusted server-generated form configuration, so authenticated lower-privileged users, or a CSRF attack, could invoke lookups or mutations outside their authorisation (CVE-2026-63265). Fixed in the Regular Labs security release of 22 July 2026 (6.3.8). Affected versions: ≤ 6.3.7 Full advisory: [our disclosure post](https://mysites.guru/blog/regular-labs-joomla-extension-security-release/) ## Our disclosure post [![Regular Labs Patched Its Whole Joomla Extension Catalogue at Once](https://mysites.guru/_astro/regular-labs-joomla-extension-security-release.BEGGx_Zx_mOFLY.webp) ### Regular Labs Patched Its Whole Joomla Extension Catalogue at Once Regular Labs shipped a security-hardening update across its Joomla extension range on 22 July 2026: SSRF, command injection, stored XSS and more. No CVEs. 22 Jul 2026 ](https://mysites.guru/blog/regular-labs-joomla-extension-security-release/) ## Other vulnerabilities in Snippets, Tabs & Accordions, Advanced Module Manager, Quick Index, Regular Labs CDN, Regular Labs DB Replacer, Regular Labs IP Login and Regular Labs Extension Manager Updating for CVE-2026-63265 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extensions. ### [Snippets](https://mysites.guru/vulnerabilities/snippets/) Latest safe version: 11.0.0 - [CVE-2026-88852](https://mysites.guru/vulnerabilities/CVE-2026-88852/) High, from 10.0.0 up to but not including 11.0.0 - [CVE-2026-63684](https://mysites.guru/vulnerabilities/CVE-2026-63684/) Medium, up to and including 9.3.10 - [CVE-2026-64792](https://mysites.guru/vulnerabilities/CVE-2026-64792/) Medium, up to and including 9.3.10 ### [Tabs & Accordions](https://mysites.guru/vulnerabilities/tabsaccordions/) Latest safe version: 3.2.0 - [CVE-2026-100751](https://mysites.guru/vulnerabilities/CVE-2026-100751/) High, from 2.3.0 up to but not including 3.2.0 - [CVE-2026-85191](https://mysites.guru/vulnerabilities/CVE-2026-85191/) High, from 3.0.0 up to but not including 3.1.0 - [CVE-2026-64792](https://mysites.guru/vulnerabilities/CVE-2026-64792/) Medium, up to and including 2.5.6 ### [Advanced Module Manager](https://mysites.guru/vulnerabilities/advancedmodules/) Latest safe version: 12.1.0 - [CVE-2026-85188](https://mysites.guru/vulnerabilities/CVE-2026-85188/) Medium, from 12.0.0 up to but not including 12.1.0 - [CVE-2026-63280](https://mysites.guru/vulnerabilities/CVE-2026-63280/) Medium, up to and including 11.0.1 - [CVE-2026-63281](https://mysites.guru/vulnerabilities/CVE-2026-63281/) Medium, up to and including 11.0.1 - [CVE-2026-63683](https://mysites.guru/vulnerabilities/CVE-2026-63683/) Medium, up to and including 11.0.1 ### [Quick Index](https://mysites.guru/vulnerabilities/quickindex/) Latest safe version: 5.0.5 - [CVE-2026-85190](https://mysites.guru/vulnerabilities/CVE-2026-85190/) High, from 5.0.0 up to but not including 5.0.5 ### Regular Labs CDN - [CVE-2026-65712](https://mysites.guru/vulnerabilities/CVE-2026-65712/) Medium, up to and including 7.3.7 ### Regular Labs DB Replacer - [CVE-2026-63685](https://mysites.guru/vulnerabilities/CVE-2026-63685/) High, up to and including 8.2.7 ### Regular Labs IP Login - [CVE-2026-64797](https://mysites.guru/vulnerabilities/CVE-2026-64797/) High, up to and including 6.2.5 - [CVE-2026-64798](https://mysites.guru/vulnerabilities/CVE-2026-64798/) High, up to and including 6.2.5 ### Regular Labs Extension Manager - [CVE-2026-64791](https://mysites.guru/vulnerabilities/CVE-2026-64791/) High, up to and including 9.2.5 ## References - [CVE-2026-63265 on cve.org (the official CVE record)](https://www.cve.org/CVERecord?id=CVE-2026-63265) - [CVE-2026-63265 in the NIST National Vulnerability Database](https://nvd.nist.gov/vuln/detail/CVE-2026-63265) - [Regular Labs Patched Its Whole Joomla Extension Catalogue at Once](https://mysites.guru/blog/regular-labs-joomla-extension-security-release/) ## CVE-2026-63265 questions Show all Which versions are affected by CVE-2026-63265? [CVE-2026-63265](https://mysites.guru/vulnerabilities/CVE-2026-63265/) is covered by 10 rules: Regular Labs DB Replacer up to and including 8.2.7; Regular Labs IP Login up to and including 6.2.5; Regular Labs Extension Manager up to and including 9.2.5; Snippets up to and including 9.3.10; Tabs & Accordions up to and including 2.5.6; Advanced Module Manager up to and including 11.0.1; Quick Index up to and including 4.3.6; Regular Labs Better Frontend Link up to and including 2.2.5; Regular Labs CDN up to and including 7.3.7; Regular Labs Email Protector up to and including 6.3.7. How do I fix CVE-2026-63265? It depends on the extension and release line your site runs. For Regular Labs DB Replacer up to and including 8.2.7: update Regular Labs DB Replacer to the newest release from the vendor. This flaw covers versions up to 8.2.7, so any later release is outside it. For Regular Labs IP Login up to and including 6.2.5: update Regular Labs IP Login to the newest release from the vendor. This flaw covers versions up to 6.2.5, so any later release is outside it. For Regular Labs Extension Manager up to and including 9.2.5: update Regular Labs Extension Manager to the newest release from the vendor. This flaw covers versions up to 9.2.5, so any later release is outside it. For Snippets up to and including 9.3.10: update Snippets to the newest release from the vendor. This flaw covers versions up to 9.3.10, so any later release is outside it. For Tabs & Accordions up to and including 2.5.6: update Tabs & Accordions to the newest release from the vendor. This flaw covers versions up to 2.5.6, so any later release is outside it. For Advanced Module Manager up to and including 11.0.1: update Advanced Module Manager to the newest release from the vendor. This flaw covers versions up to 11.0.1, so any later release is outside it. For Quick Index up to and including 4.3.6: update Quick Index to the newest release from the vendor. This flaw covers versions up to 4.3.6, so any later release is outside it. For Regular Labs Better Frontend Link up to and including 2.2.5: update Regular Labs Better Frontend Link to the newest release from the vendor. This flaw covers versions up to 2.2.5, so any later release is outside it. For Regular Labs CDN up to and including 7.3.7: update Regular Labs CDN to the newest release from the vendor. This flaw covers versions up to 7.3.7, so any later release is outside it. For Regular Labs Email Protector up to and including 6.3.7: update Regular Labs Email Protector to the newest release from the vendor. This flaw covers versions up to 6.3.7, so any later release is outside it. How severe is CVE-2026-63265? CISA-ADP scores it 8.0 (High) under CVSS 3.1. In plain terms: reachable across the internet, any logged-in account will do and someone has to click or visit something. ## Running an affected version on a site you manage? A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, [fix.mysites.guru](https://fix.mysites.guru/) is a single fixed fee per incident, usually resolved the same day. This check is part of the [mySites.guru Joomla vulnerability scanner](https://mysites.guru/joomla-vulnerability-scanner/), which reads every installed extension's version on each audit. Browse the rest of the [Joomla vulnerability database](https://mysites.guru/vulnerabilities/). Rules current as of 14 October 2026.