# CVE-2026-63280: Regular Labs Joomla extensions improper access control in conditions administration

Source: https://junglewise.ai/threats/cve-2026-63280-regular-labs-joomla-extensions-improper-access-control-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-22. Updated: 2026-07-22  
License: CC BY 4.0 with a link back

CVE-2026-63280 · Severity: info · Published 2026-07-22

Multiple Regular Labs extensions for the Joomla content management system fail to properly validate security tokens and user permissions within their administration interfaces. These extensions are used to manage how content and modules are displayed on a website. An attacker could potentially bypass security checks to modify site configurations or content settings, leading to unauthorized changes to the website's behavior or appearance.

Technologies: [Regular Labs Advanced Module Manager](https://junglewise.ai/threats/technologies/advanced-module-manager), [Regular Labs Conditional Content](https://junglewise.ai/threats/technologies/conditional-content), [Regular Labs Content Templater Pro](https://junglewise.ai/threats/technologies/content-templater-pro), [Regular Labs ReReplacer Pro](https://junglewise.ai/threats/technologies/rereplacer-pro). Vendors: [Regular Labs](https://junglewise.ai/threats/vendors/regular-labs).

## Quick answers

**Is CVE-2026-63280 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63280 being exploited in the wild.

**How severe is CVE-2026-63280?** Informational severity, published 22 July 2026.

**Which products and versions are affected?** Regular Labs Advanced Module Manager 1.0.0-11.0.1; Regular Labs Conditional Content 1.0.0-6.0.0; Regular Labs Content Templater Pro 1.0.0-13.0.0.

**Is there a fix for CVE-2026-63280?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-63280 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-63280?** Check whether you run Regular Labs Advanced Module Manager, Regular Labs Conditional Content, Regular Labs Content Templater Pro or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Multiple Regular Labs extensions for Joomla (Advanced Module Manager, Conditional Content, Content Templater Pro, and ReReplacer Pro) are vulnerable to improper access control (CWE-284) and Cross-Site Request Forgery (CWE-352). The vulnerability exists within the 'conditions' administration interface, where the software fails to consistently enforce security tokens and verify component or mapped-item permissions. A remote attacker could exploit this to perform unauthorized administrative actions or modify configuration settings if they can trick an authenticated administrator into visiting a malicious link or if they can bypass the inconsistent permission checks. Affected versions range across several products, generally covering versions from 1.0.0 up to the specific patched releases identified in the advisory.

## Affected products

- Regular Labs Advanced Module Manager extension for Joomla 1.0.0-11.0.1
- Regular Labs Conditional Content extension for Joomla 1.0.0-6.0.0
- Regular Labs Content Templater Pro extension for Joomla 1.0.0-13.0.0
- Regular Labs ReReplacer extension Pro for Joomla 1.0.0-15.0.3

## Timeline

- 2026-07-22: disclosed: CVE published by Joomla! Project via NVD

## References

- [https://regularlabs.com/](https://regularlabs.com/)

## Related threats

- [Regular Labs Conditional Content authenticated remote code execution in Joomla](https://junglewise.ai/threats/cve-2026-85192-regular-labs-conditional-content-authenticated-remote-code)
- [Regular Labs Advanced Module Manager database disclosure in Conditions editor](https://junglewise.ai/threats/cve-2026-85188-regular-labs-advanced-module-manager-database-disclosure-in)
- [Regular Labs ReReplacer Pro path traversal in XML include paths](https://junglewise.ai/threats/cve-2026-65754-regular-labs-rereplacer-pro-path-traversal-in-xml-include-paths)
- [Regular Labs Joomla extensions sensitive information disclosure in Smart Search](https://junglewise.ai/threats/cve-2026-64792-regular-labs-joomla-extensions-sensitive-information-disclosure)
- [Regular Labs Joomla extensions location bypass via IP spoofing](https://junglewise.ai/threats/cve-2026-63683-regular-labs-joomla-extensions-location-bypass-via-ip-spoofing)