Executive brief
The Cache Cleaner Pro extension for Joomla, which helps administrators manage website performance by clearing cached data, was found to leak sensitive credentials. Specifically, Content Delivery Network (CDN) authentication details were included in the web addresses (URLs) used by administrators. This could allow unauthorized individuals with access to server logs or browser history to gain control over the website's CDN, potentially leading to content manipulation or service disruption.
Technical details
The Regular Labs Cache Cleaner Pro extension for Joomla (versions 1.0.0 through 9.7.6) suffers from an information disclosure vulnerability (CWE-200). Sensitive CDN credentials are leaked by being included directly in the query parameters of administrator request URLs. An attacker with access to HTTP logs, proxy logs, or browser history could extract these credentials to gain unauthorized access to the configured CDN provider. This vulnerability is triggered during normal administrative operations within the Joomla backend. Users should update to a version beyond 9.7.6 if available.
Affected products
- Regular Labs Cache Cleaner Pro extension for Joomla 1.0.0-9.7.6
Timeline
- 2026-07-23: disclosed: CVE published by the Joomla! Project