CVE-2026-63280

Deferred Deferred - Pending Action

Conditions Administration Token and Permission Bypass in Joomla

Publication date: 2026-07-22

Last updated on: 2026-07-27

Assigner: Joomla! Project

Description

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs conditions manager - Conditions administration did not consistently enforce tokens and component/mapped-item permissions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-22

Last Modified

2026-07-27

Generated

2026-08-12

AI Q&A

2026-07-23

EPSS Evaluated

2026-08-10

NVD

CVE-2026-63280

Affected Vendors & Products

Vendor	Product	Version / Range
regularlabs	conditions_manager	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability involves conditions administration not consistently enforcing tokens and component/mapped-item permissions. This means that access controls may fail to restrict unauthorized actions properly, potentially allowing users to perform actions beyond their intended permissions.

Impact Analysis

This vulnerability could allow unauthorized users to access or modify sensitive data, perform administrative actions, or escalate privileges. It may lead to data breaches, system compromise, or compliance violations depending on the affected system's use case.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating principles of data protection and privacy required by GDPR and HIPAA. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Update Joomla to the latest version to ensure all permission checks are enforced correctly. Review component and mapped-item permissions to confirm they align with intended access controls.

Hi! I’m here to help you understand CVE-2026-63280. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70