CVE-2026-63684 | Administrator actions, editor popups and import/export reque…

Description

Administrator actions, editor popups and import/export requests lacked consistent token, item-permission and input-validation checks. Unauthorized backend users or CSRF attacks could expose, create or modify extension configuration and items.

Metadata

CVE ID: CVE-2026-63684
State: PUBLISHED
Assigner: Joomla
Reserved: 2026-07-17 15:49 UTC
Published: 2026-07-22 20:39 UTC
Last updated: 2026-07-22 21:02 UTC
Primary CWE: CWE-352
CWE-352 Cross-Site Request Forgery (CSRF)
Vendor / Product: regularlabs.com / Content Templater extension for Joomla
Sources: cve.org · NVD

Severity & Metrics

No CVSS data available.

Affected products (3)

Vendor	Product	Platform	Versions
regularlabs.com	Content Templater extension for Joomla	—	1.0.0-13.0.0
regularlabs.com	ReReplacer extension for Joomla	—	1.0.0-15.0.3
regularlabs.com	Snippets extension for Joomla	—	1.0.0-9.3.10

Weakness (CWE)

CWE	Source	Description
CWE-284	cna	CWE-284 Improper Access Control
CWE-352	cna	CWE-352 Cross-Site Request Forgery (CSRF)

References (1)

https://regularlabs.com/