Vulnerability · Published Jul 22, 2026 · Assigned by Joomla

CVE-2026-64791Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs Extension Manager

High 8.8

In plain English

A high-severity cross-site request forgery in Regular Labs Extension Manager extension for Joomla from regularlabs.com. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.2%top 90.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs Extension Manager - Administrator routes and install/update/uninstall processing did not consistently enforce component-management and installation permissions. An unauthorized backend user or CSRF attack could install, update or remove extensions.

Affected products (as reported)

Vendor	Product	Versions
regularlabs.com	Regular Labs Extension Manager extension for Joomla	1.0.0-9.2.5

Weakness: CWE-352, CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://regularlabs.com/ product