External risk intelligence

Joomla Extensions Vulnerable to Content Access Bypass

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-64793

This vulnerability affects Joomla content management extensions that are designed to render and display content on public-facing websites. Because these extensions are integrated into the core web-publishing functionality of an internet-accessible CMS, the affected components are commonly reachable by any visitor to the website.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in certain Joomla content management extensions that could allow unauthorized users to view restricted or unpublished content. The issue stems from how content tags handle access controls, potentially enabling unintended content exposure to website visitors. The primary concern is to confirm if these specific extensions are in use and if exposure is possible.

Content access controls could be bypassed.
Confirms use and exposure of affected extensions.
Verify if restricted content is exposed.

Attack Path

How an attacker could exploit the issue

An attacker could leverage content tags within Joomla extensions to bypass access controls, allowing them to display restricted or unpublished articles and modules to unauthorized visitors. This could expose sensitive information or functionality that should only be accessible to privileged users.

No authentication required.
Content tags misuse bypasses access controls.
Unauthorized content exposure.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow content authors to bypass access controls, potentially exposing restricted or unpublished articles and modules to any website visitor. When supported by the advisory, this could lead to unauthorized access to sensitive information or control over displayed content.

Restricted or unpublished content.
Bypassed access controls during rendering.
Unauthorized content exposure to visitors.

Operational Fix

Recommended remediation, mitigation, and detection steps

Content owners and web administrators are primarily responsible for addressing this vulnerability, as it affects how content is displayed on public-facing websites. The first practical step is to identify all instances of the affected Joomla extensions, confirm their accessibility and criticality, and then assign an accountable owner for remediation.

Assign ownership to content or web administrators.
Verify extension reachability and business criticality.
Plan content owner notification and remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Articles Anywhere extension for Joomla?

Articles Anywhere and Modules Anywhere are Joomla extensions from Regular Labs designed to help site administrators easily insert and render content—like articles or modules—directly into pages using specific tags. They act as a bridge between Joomla's database and the front-end layout, automating how dynamic content appears to visitors.

How does CVE-2026-64793 bypass access controls?

This vulnerability relates to CWE-284, Improper Access Control. It occurs because the extensions do not properly respect Joomla's permission settings when processing certain content tags. By including specific flags or property overrides within these tags, the system can be tricked into rendering content that should be hidden or restricted, essentially ignoring the visibility rules set for those items.

Do I need to be an admin to trigger this bug?

No, authentication is not a requirement to trigger this issue. The vulnerability lies in how the extensions process tags during page rendering. However, it is important to note that this is not an arbitrary code execution bug; it only affects the display of existing, restricted content. It does not allow an attacker to gain administrative access to the Joomla backend or modify site files.

Is my website at risk from this vulnerability?

According to Halo Surface Signal, this risk is likely because these extensions are built to display content on public-facing sites. Since the extension is integrated into the web-publishing workflow, any visitor to your site can potentially trigger the tag-based bypass. If your Joomla instance uses these extensions to pull content, your site is effectively reachable and potentially exposed.

What should I do first to manage this CVE?

Begin by auditing your Joomla installation to confirm whether you have Articles Anywhere or Modules Anywhere installed. Once identified, evaluate which pages utilize these content tags and whether any of that content is sensitive or restricted. Coordinate with your site administrators to review those specific tag implementations while waiting for official vendor guidance or security updates from Regular Labs.

References

regularlabs.com/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.