CVE-2026-64792 Information disclosure in Articles Anywhere extension for Joomla
Attackers can view restricted content via public search index because indexing uses admin identity instead of guest.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-64792?
CVE-2026-64792 is a high-severity vulnerability in regularlabs.com Articles Anywhere extension for Joomla, published on 22 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Joomla Extension - regularlabs.com - disclosure of restricted content via search index in various Regular Labs extensions - Smart Search indexing could render generated content using the indexing administrator’s identity instead of a public guest. Restricted or administrator-only content could consequently be stored in the public search index and disclosed to visitors.
Weakness: CWE-524
Which versions are affected by CVE-2026-64792?
How do I fix CVE-2026-64792?
No fix has been published for CVE-2026-64792 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-64792 being exploited?
There is no known exploitation of CVE-2026-64792 in the wild and no public exploit code.
Sources
Also known as GHSA-wjgr-cpjg-f2q7.