CVE-2026-85188 Information disclosure in Advanced Module Manager (Free, Pro) extension for Joomla
Attackers can read arbitrary database fields by manipulating table and column names in the Conditions editor of affected Regular Labs Joomla extensions.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-85188?
CVE-2026-85188 is a medium-severity vulnerability in regularlabs.com Advanced Module Manager (Free, Pro) extension for Joomla, published on 14 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Joomla Extension - regularlabs.com - Database data disclosure in Advanced Module Manager (Free, Pro) < 12.1.0, Conditional Content (Free, Pro) < 8.0.0, Content Templater (Pro) < 14.2.0, ReReplacer (Pro) < 16.2.0 for Joomla - The Conditions editor creates a default Condition Set name from the item to which the set is linked. The affected code accepts the database table and label-column names from the request. Although these names are quoted as SQL identifiers, they are not restricted to the tables and columns used by supported Regular Labs integrations. An attacker can therefore select a valid but unrelated database field. This is an authorization failure rather than SQL injection.
Weakness: CWE-200
Which versions are affected by CVE-2026-85188?
How do I fix CVE-2026-85188?
No fix has been published for CVE-2026-85188 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-85188 being exploited?
There is no known exploitation of CVE-2026-85188 in the wild and no public exploit code.
Sources
Also known as GHSA-6mhq-4w43-x55v.