Regular Labs Extension Manager (com_regularlabsmanager) <= 9.2.5 - Broken Access Control (unauthorised extension install/update/uninstall)

Regular Labs Extension Manager up to and including 9.2.5. Administrator routes and the install/update/uninstall processing did not consistently enforce component-management and installation permissions, so an unauthorised backend user, or a CSRF attack against a logged-in administrator, could install, update or remove Joomla extensions - which is a site takeover primitive. Also affected by CVE-2026-63265, missing CSRF tokens and permission checks on the shared Regular Labs AJAX endpoints. Fixed in the Regular Labs security release of 22 July 2026 (9.3.0). Update via Joomla Update or the Regular Labs Extension Manager.

Affected versions: ≤ 9.2.5

Official record: cve.org · NVD

Every connected Joomla site is checked against this rule on each audit, and flagged if it runs an affected version.

Affected extensions and versions

Our disclosure post

Regular Labs Patched Its Whole Joomla Extension Catalogue at Once

Regular Labs shipped a security-hardening update across its Joomla extension range on 22 July 2026: SSRF, command injection, stored XSS and more. No CVEs.

22 Jul 2026