CVE-2026-64796

UNKNOWN

Published 2026-07-22 · Source security@joomla.org

Description

Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did not consistently enforce configured CSS, JavaScript and PHP permissions across tags, attributes, files and both article owners. PHP include attributes could also escape the configured include folder, and executable script/style variants could bypass detection.

CWE-284

References

https://regularlabs.com/

View on NVD

Related CVEs

Same severity, most recent

CVE-2026-64798
Persistent URL login keys were also generated using a non-cryptographic random generator with insufficient entropy.
2026-07-22 · score —
CVE-2026-64797
IP Login trusted forwarded client-IP headers without requiring a configured trusted proxy. Attackers could spoof the IP used for automatic login and potentially impersonate mapped accounts.
2026-07-22 · score —
CVE-2026-64795
Tag-provided custom HTML, module content/title overrides and decoded modal or tooltip values could execute unsafe markup. A content author could inject JavaScript that ran in visitors’ browsers.
2026-07-22 · score —
CVE-2026-64794
User tags, filters and conditions allowed access to insufficiently restricted user fields. Crafted content could expose authentication-related data, raw user parameters or restricted contact details.
2026-07-22 · score —
CVE-2026-64793
Content tags could use ignore flags or property overrides to render restricted or unpublished articles or modules. A content author could thereby expose content to visitors who lacked the required access.
2026-07-22 · score —