# Regular Labs Snippets (com_snippets) <= 9.3.10 - Broken Access Control and Search Index Content Disclosure [Joomla Vulnerability Database](https://mysites.guru/vulnerabilities/)/CVE-2026-64792 CVE-2026-64792HighCVSS 7.5CVE published 22 July 2026Added to mySites.guru 22 July 2026 # Regular Labs Snippets (com\_snippets) <= 9.3.10 - Broken Access Control and Search Index Content Disclosure Regular Labs Snippets up to and including 9.3.10. Administrator actions, editor popups and import/export requests lacked consistent token, item-permission and input-validation checks, so unauthorised backend users or a CSRF attack could expose, create or modify extension configuration and items (CVE-2026-63684). Smart Search indexing could also store restricted content in the public search index (CVE-2026-64792), and the shared Regular Labs AJAX endpoints lacked consistent CSRF and permission checks (CVE-2026-63265). Fixed in the Regular Labs security release of 22 July 2026 (10.0.0). Note this rule matches the com\_snippets component deliberately: the plugin element "snippets" is also used by the unrelated "Page Builder CK - Snippets" plugin. Copy citation ## Is my site affected? CVE-2026-64792 is checked by 3 rules. Find the extension and release line your site runs: Extension Affected versions Fixed in What to do [Snippets](https://mysites.guru/vulnerabilities/snippets/) up to and including 9.3.10 after 9.3.10 Update Snippets to the newest release from the vendor. This flaw covers versions up to 9.3.10, so any later release is outside it. [Tabs & Accordions](https://mysites.guru/vulnerabilities/tabsaccordions/) up to and including 2.5.6 after 2.5.6 Update Tabs & Accordions to the newest release from the vendor. This flaw covers versions up to 2.5.6, so any later release is outside it. [Conditional Content](https://mysites.guru/vulnerabilities/conditionalcontent/) up to and including 6.0.0 after 6.0.0 Update Conditional Content to the newest release from the vendor. This flaw covers versions up to 6.0.0, so any later release is outside it. [Check whether your sites are affected](https://mysites.guru/free-audit/) ## How CVE-2026-64792 is scored The base metrics as CISA-ADP published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw. 7.5 High CVSS 3.1, scored by CISA-ADP `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N` ### How it is reached - **AV:N Attack vector** - Network. Reachable across the internet - **AC:L Attack complexity** - Low. Nothing to work around, it just works - **PR:N Privileges required** - None. No account needed - **UI:N User interaction** - None. Nobody has to be tricked into anything - **S:U Scope** - Unchanged. Contained to the extension it is in ### What it does - **C:H Confidentiality** - High. Everything the site holds can be read - **I:N Integrity** - None. Nothing can be altered - **A:N Availability** - None. The site stays up The rule below is rated Medium for the set of 3 CVEs it covers together, not for this record on its own. ## Timeline 1. 22 July 2026CVE-2026-64792 record published by its CNA 2. 22 July 2026mySites.guru check added for Snippets (up to and including 9.3.10) 3. 22 July 2026mySites.guru check added for Tabs & Accordions (up to and including 2.5.6) 4. 22 July 2026mySites.guru check added for Conditional Content (up to and including 6.0.0) 5. 22 July 2026[We published: Regular Labs Patched Its Whole Joomla Extension Catalogue at Once](https://mysites.guru/blog/regular-labs-joomla-extension-security-release/) ## Rule details Medium[CVE-2026-63684](https://mysites.guru/vulnerabilities/CVE-2026-63684/)[CVE-2026-64792](https://mysites.guru/vulnerabilities/CVE-2026-64792/)[CVE-2026-63265](https://mysites.guru/vulnerabilities/CVE-2026-63265/)2026-07-22 [Snippets](https://mysites.guru/vulnerabilities/snippets/) Affected versions: ≤ 9.3.10 Full advisory: [our disclosure post](https://mysites.guru/blog/regular-labs-joomla-extension-security-release/) Medium[CVE-2026-64792](https://mysites.guru/vulnerabilities/CVE-2026-64792/)[CVE-2026-63265](https://mysites.guru/vulnerabilities/CVE-2026-63265/)2026-07-22 [Tabs & Accordions](https://mysites.guru/vulnerabilities/tabsaccordions/) - Regular Labs Tabs & Accordions (tabsaccordions) <= 2.5.6 - Access Control and Search Index Content Disclosure Regular Labs Tabs & Accordions up to and including 2.5.6. Smart Search indexing could render generated content using the indexing administrator identity instead of a public guest, so restricted or administrator-only content could be stored in the public search index and disclosed to visitors (CVE-2026-64792). Also affected by CVE-2026-63265, missing CSRF tokens and permission checks on the shared Regular Labs AJAX endpoints. Fixed in the Regular Labs security release of 22 July 2026 (3.0.0). Affected versions: ≤ 2.5.6 Full advisory: [our disclosure post](https://mysites.guru/blog/regular-labs-joomla-extension-security-release/) Medium[CVE-2026-63280](https://mysites.guru/vulnerabilities/CVE-2026-63280/)[CVE-2026-63281](https://mysites.guru/vulnerabilities/CVE-2026-63281/)[CVE-2026-63683](https://mysites.guru/vulnerabilities/CVE-2026-63683/)[CVE-2026-64792](https://mysites.guru/vulnerabilities/CVE-2026-64792/)2026-07-22 [Conditional Content](https://mysites.guru/vulnerabilities/conditionalcontent/) - Regular Labs Conditional Content (conditionalcontent) <= 6.0.0 - Broken Access Control, Stored XSS and GeoIP Rule Bypass Regular Labs Conditional Content up to and including 6.0.0, via the bundled Conditions component and the shared Regular Labs library. Conditions administration did not consistently enforce tokens and component/mapped-item permissions (CVE-2026-63280); stored condition values could execute HTML/JavaScript in administrator summaries (CVE-2026-63281); IP and GeoIP conditions trusted spoofable forwarded headers (CVE-2026-63683); Smart Search indexing could store restricted content in the public index (CVE-2026-64792); and the Regular Labs AJAX endpoints lacked consistent CSRF and permission checks (CVE-2026-63265). Fixed in the Regular Labs security release of 22 July 2026 (7.0.0). Affected versions: ≤ 6.0.0 Full advisory: [our disclosure post](https://mysites.guru/blog/regular-labs-joomla-extension-security-release/) ## Our disclosure post [![Regular Labs Patched Its Whole Joomla Extension Catalogue at Once](https://mysites.guru/_astro/regular-labs-joomla-extension-security-release.BEGGx_Zx_mOFLY.webp) ### Regular Labs Patched Its Whole Joomla Extension Catalogue at Once Regular Labs shipped a security-hardening update across its Joomla extension range on 22 July 2026: SSRF, command injection, stored XSS and more. No CVEs. 22 Jul 2026 ](https://mysites.guru/blog/regular-labs-joomla-extension-security-release/) ## Other vulnerabilities in Snippets, Tabs & Accordions and Conditional Content Updating for CVE-2026-64792 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extensions. ### [Snippets](https://mysites.guru/vulnerabilities/snippets/) Latest safe version: 11.0.0 - [CVE-2026-88852](https://mysites.guru/vulnerabilities/CVE-2026-88852/) High, from 10.0.0 up to but not including 11.0.0 - [CVE-2026-63684](https://mysites.guru/vulnerabilities/CVE-2026-63684/) Medium, up to and including 9.3.10 - [CVE-2026-63265](https://mysites.guru/vulnerabilities/CVE-2026-63265/) Medium, up to and including 9.3.10 ### [Tabs & Accordions](https://mysites.guru/vulnerabilities/tabsaccordions/) Latest safe version: 3.2.0 - [CVE-2026-100751](https://mysites.guru/vulnerabilities/CVE-2026-100751/) High, from 2.3.0 up to but not including 3.2.0 - [CVE-2026-85191](https://mysites.guru/vulnerabilities/CVE-2026-85191/) High, from 3.0.0 up to but not including 3.1.0 - [CVE-2026-63265](https://mysites.guru/vulnerabilities/CVE-2026-63265/) Medium, up to and including 2.5.6 ### [Conditional Content](https://mysites.guru/vulnerabilities/conditionalcontent/) Latest safe version: 8.0.0 - [CVE-2026-85192](https://mysites.guru/vulnerabilities/CVE-2026-85192/) Critical, from 7.0.0 up to but not including 8.0.0 - [CVE-2026-85188](https://mysites.guru/vulnerabilities/CVE-2026-85188/) Critical, from 7.0.0 up to but not including 8.0.0 - [CVE-2026-63280](https://mysites.guru/vulnerabilities/CVE-2026-63280/) Medium, up to and including 6.0.0 - [CVE-2026-63281](https://mysites.guru/vulnerabilities/CVE-2026-63281/) Medium, up to and including 6.0.0 - [CVE-2026-63683](https://mysites.guru/vulnerabilities/CVE-2026-63683/) Medium, up to and including 6.0.0 ## References - [CVE-2026-64792 on cve.org (the official CVE record)](https://www.cve.org/CVERecord?id=CVE-2026-64792) - [CVE-2026-64792 in the NIST National Vulnerability Database](https://nvd.nist.gov/vuln/detail/CVE-2026-64792) - [Regular Labs Patched Its Whole Joomla Extension Catalogue at Once](https://mysites.guru/blog/regular-labs-joomla-extension-security-release/) ## CVE-2026-64792 questions Show all Which versions are affected by CVE-2026-64792? [CVE-2026-64792](https://mysites.guru/vulnerabilities/CVE-2026-64792/) is covered by 3 rules: Snippets up to and including 9.3.10; Tabs & Accordions up to and including 2.5.6; Conditional Content up to and including 6.0.0. How do I fix CVE-2026-64792? It depends on the extension and release line your site runs. For Snippets up to and including 9.3.10: update Snippets to the newest release from the vendor. This flaw covers versions up to 9.3.10, so any later release is outside it. For Tabs & Accordions up to and including 2.5.6: update Tabs & Accordions to the newest release from the vendor. This flaw covers versions up to 2.5.6, so any later release is outside it. For Conditional Content up to and including 6.0.0: update Conditional Content to the newest release from the vendor. This flaw covers versions up to 6.0.0, so any later release is outside it. How severe is CVE-2026-64792? CISA-ADP scores it 7.5 (High) under CVSS 3.1. In plain terms: reachable across the internet, no account needed and nobody has to be tricked into anything. ## Running an affected version on a site you manage? A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, [fix.mysites.guru](https://fix.mysites.guru/) is a single fixed fee per incident, usually resolved the same day. This check is part of the [mySites.guru Joomla vulnerability scanner](https://mysites.guru/joomla-vulnerability-scanner/), which reads every installed extension's version on each audit. Browse the rest of the [Joomla vulnerability database](https://mysites.guru/vulnerabilities/). Rules current as of 14 October 2026.