Regular Labs DB Replacer (com_dbreplacer) <= 8.2.7 - Broken Access Control (unauthorised database replacements)

Regular Labs DB Replacer up to and including 8.2.7. Administrator routes and replacement requests did not consistently require Super User permission and a valid token, so an unauthorised backend user or a CSRF attack could run database replacements across the site - potentially causing major data corruption or full site compromise. Also affected by CVE-2026-63265, missing CSRF tokens and permission checks on the shared Regular Labs AJAX endpoints. Fixed in the Regular Labs security release of 22 July 2026 (9.0.0).

Affected versions: ≤ 8.2.7

Official record: cve.org · NVD

Every connected Joomla site is checked against this rule on each audit, and flagged if it runs an affected version.

Affected extensions and versions

Our disclosure post

Regular Labs Patched Its Whole Joomla Extension Catalogue at Once

Regular Labs shipped a security-hardening update across its Joomla extension range on 22 July 2026: SSRF, command injection, stored XSS and more. No CVEs.

22 Jul 2026