CVE-2026-64791 Cross-site request forgery in Regular Labs Extension Manager extension for Joomla
Attackers can install, update, or remove extensions via CSRF or unauthorized access due to inconsistent permission checks in Regular Labs Extension Manager.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-64791?
CVE-2026-64791 is a high-severity vulnerability in regularlabs.com Regular Labs Extension Manager extension for Joomla, published on 22 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs Extension Manager - Administrator routes and install/update/uninstall processing did not consistently enforce component-management and installation permissions. An unauthorized backend user or CSRF attack could install, update or remove extensions.
Which versions are affected by CVE-2026-64791?
How do I fix CVE-2026-64791?
No fix has been published for CVE-2026-64791 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-64791 being exploited?
There is no known exploitation of CVE-2026-64791 in the wild and no public exploit code.
Sources
Also known as GHSA-gfvr-rf79-h88g.