CVE-2026-64793
A Joomla extension from regularlabs.com allows content authors to bypass access controls and publish restricted or unpublished articles and modules. By using ignore flags or property overrides, an author can expose sensitive content to visitors who normally cannot see it. This flaw is critical because it can leak confidential information without any authentication or user interaction.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Joomla extensions Articles Anywhere and Modules Anywhere by regularlabs.com. Users who have these extensions installed and allow content authors to use tags are affected.
Real-world impact
An attacker or malicious content author could expose restricted or unpublished articles and modules to all site visitors, potentially revealing confidential or sensitive information.
Why this severity
The CVSS score of 9.1 reflects the high confidentiality impact, the lack of required privileges or user interaction, and the fact that the vulnerability can be exploited remotely by anyone who can use the extension’s content tags.
What to do about it
- ›Disable or remove the vulnerable Articles Anywhere and Modules Anywhere extensions until a patch is released.
- ›Restrict content author permissions so that they cannot use ignore flags or property overrides to publish restricted content.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jul 22, 2026 · 10d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 27, 2026 · 5d agoAdvisory updatedThe NVD record was last revised.