CVE-2026-65757

Full vulnerability record from the local CVENow database.

Description

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules Anywhere extension - The editor popup could expose restricted module data to authenticated users without the required module permissions or valid request tokens.

Severity

HIGH

CVSS score

8.1 (v3.1)

Vulnerability status

Deferred

Source identifier

[email protected]

Published

2026-07-23 10:16:53.353000

Last modified

2026-10-24 13:10:00.147000

View original CVE JSON

{
  "id": "CVE-2026-65757",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-23T10:16:53.353",
  "lastModified": "2026-10-24T13:10:00.147",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules Anywhere extension - The editor popup could expose restricted module data to authenticated users without the required module permissions or valid request tokens."
    },
    {
      "lang": "es",
      "value": "Extensión de Joomla - regularlabs.com - Comprobaciones inconsistentes de tokens CSRF / comprobaciones de privilegios en la extensión Modules Anywhere - La ventana emergente del editor podría exponer datos de módulos restringidos a usuarios autenticados sin los permisos de módulo requeridos o tokens de solicitud válidos."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "regularlabs.com",
          "product": "Modules Anywhere extension for Joomla",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "1.0.0-8.4.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-24T20:01:56.979366Z",
          "id": "CVE-2026-65757",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        },
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://regularlabs.com/",
      "source": "[email protected]"
    }
  ]
}