CVE-2026-64871

Deferred Deferred - Pending Action

Joomla Administrator URL Purge Authentication Bypass

Publication date: 2026-07-23

Last updated on: 2026-07-24

Assigner: Joomla! Project

Description

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Cache Cleaner extension - Administrator URL purges did not consistently require a valid token and cache-management permission.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-23

Last Modified

2026-07-24

Generated

2026-08-12

AI Q&A

2026-07-23

EPSS Evaluated

2026-08-11

NVD

CVE-2026-64871

EUVD

EUVD-2026-47896

Affected Vendors & Products

Vendor	Product	Version / Range
regular_labs	advanced_module_manager	*
regular_labs	articles_anywhere	*
regular_labs	cache_cleaner	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability involves the Joomla administrator URL purge functionality not consistently requiring a valid token and cache-management permission. This could allow unauthorized users to perform cache purges without proper authentication.

Detection Guidance

This vulnerability involves inconsistent CSRF token checks and privilege checks in the Cache Cleaner extension for Joomla. To detect it, inspect Joomla extensions for Cache Cleaner and verify if administrator URL purges lack proper token validation and permission checks. Check server logs for unauthorized cache purge requests or unusual administrator activity.

Impact Analysis

An attacker could exploit this to clear cached data without permission, potentially disrupting website functionality or exposing sensitive information stored in cache.

Compliance Impact

This vulnerability could lead to unauthorized data exposure or manipulation, which may violate GDPR's data integrity principles or HIPAA's security requirements for protected health information.

Mitigation Strategies

Update Joomla and Regular Labs extensions to the latest versions. Ensure administrator URL purges require valid tokens and cache-management permissions. Review access logs for unauthorized purge attempts.

Hi! I’m here to help you understand CVE-2026-64871. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70