CVE-2026-64792: Regular Labs Joomla extensions sensitive information disclosure in Smart Search

CVE-2026-64792 · Severity: info · Published 2026-07-22

Multiple Joomla extensions from Regular Labs contain a flaw where the Smart Search indexing process incorrectly uses an administrator's identity to generate content. This can cause private or restricted information, intended only for administrators, to be saved into the public search index. As a result, unauthorized visitors could discover sensitive content simply by using the website's search feature.

Technologies: Regular Labs Articles Anywhere, Regular Labs Conditional Content, Regular Labs Modules Anywhere, Regular Labs ReReplacer, Regular Labs Sourcerer. Vendors: Regular Labs.

Quick answers

Is CVE-2026-64792 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-64792 being exploited in the wild.
How severe is CVE-2026-64792?
Informational severity, published 22 July 2026.
Which products and versions are affected?
Regular Labs Articles Anywhere 1.0.0-18.0.2; Regular Labs Conditional Content 1.0.0-6.0.0; Regular Labs Modules Anywhere 1.0.0-8.4.1; Regular Labs ReReplacer 1.0.0-15.0.3; and 3 more.
Is there a fix for CVE-2026-64792?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-64792 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-64792?
Check whether you run Regular Labs Articles Anywhere, Regular Labs Conditional Content, Regular Labs Modules Anywhere or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in several Regular Labs extensions for Joomla (including Articles Anywhere, Sourcerer, and others) related to how they handle Smart Search indexing. The root cause is a failure to properly isolate the security context during the indexing process, causing the system to render content using the administrator's permissions (CWE-524). Consequently, restricted or administrator-only content is stored in the public search index. An attacker or guest user can then retrieve this sensitive information through standard search queries. The issue affects multiple versions across the product suite as of July 2026.

Affected products

  • Regular Labs Articles Anywhere extension for Joomla 1.0.0-18.0.2
  • Regular Labs Conditional Content extension for Joomla 1.0.0-6.0.0
  • Regular Labs Modules Anywhere extension for Joomla 1.0.0-8.4.1
  • Regular Labs ReReplacer extension for Joomla 1.0.0-15.0.3
  • Regular Labs, Sourcerer extension for Joomla 1.0.0-12.2.8
  • Regular Labs Tabs & Accordions Pro extension for Joomla 1.0.0-2.5.6
  • Regular Labs Snippets Pro extension for Joomla 1.0.0-9.3.10

Timeline

  • 2026-07-22: disclosed: CVE record published by Joomla! Project

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.