CVE-2026-64792: Smart Search Information Disclosure Flaw

CVE-2026-64792 Overview

CVE-2026-64792 affects Smart Search indexing, where the indexer renders generated content using the indexing administrator's identity instead of a public guest identity. This context confusion causes restricted or administrator-only content to be written into the public search index. Visitors querying the site can then retrieve content they were never authorized to view. The weakness is categorized under [CWE-524]: Use of Cache Containing Sensitive Information. Regular Labs published guidance related to this issue on its security resources page.

Critical Impact
Restricted and administrator-only content may be stored in the public search index and disclosed to unauthenticated visitors through normal search queries.

Affected Products

Smart Search indexing component (Regular Labs referenced advisory)
Deployments where content ACLs restrict material to administrators or specific user groups
Public-facing sites exposing search functionality to unauthenticated visitors

Discovery Timeline

2026-07-22 - CVE-2026-64792 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-64792

Vulnerability Analysis

The vulnerability is a context confusion flaw in the Smart Search indexer. During indexing, the component renders dynamic or plugin-generated content in the security context of the administrator running the indexing job. Access control checks that rely on the current user's permissions therefore evaluate against elevated privileges. Content that would normally be hidden from a guest, such as unpublished articles, restricted category items, or administrator-only fields, is rendered in full. The rendered output is then written into the public search index used to serve visitor queries.

The indexed data persists across sessions, so exposure does not require the attacker to be present during indexing. Any subsequent search request from an unauthenticated visitor can surface fragments of the restricted material through result snippets or full item previews.

Root Cause

The root cause is improper identity propagation during background rendering. The indexer does not switch to a public guest context before invoking content rendering routines. Access control decisions inherit the administrator identity, and the resulting output bypasses the view-level restrictions expected by content authors.

Attack Vector

An unauthenticated visitor issues queries against the public search endpoint. When matches include improperly indexed restricted content, the search results reveal the sensitive material through titles, excerpts, or snippets. No authentication, privileges, or user interaction beyond a standard search query is required. Exploitation is deterministic once restricted content has been indexed under the administrator context.

No verified proof-of-concept code has been published. Refer to the Regular Labs Security Resources advisory for vendor guidance.

Detection Methods for CVE-2026-64792

Indicators of Compromise

Search result snippets containing text from unpublished, archived, or ACL-restricted articles
Anonymous or low-privileged web sessions retrieving titles of administrator-only items via /index.php?option=com_finder or equivalent search endpoints
Search index database tables (for example #__finder_links) containing entries whose source items have restricted access levels

Detection Strategies

Compare the set of items present in the Smart Search index against the ACL of each source item, flagging any indexed item whose access level is not public
Review web server logs for spikes in search queries targeting keywords likely to appear in restricted content
Audit indexing job output for content rendered outside the guest access level, especially after plugin or template changes

Monitoring Recommendations

Alert on anonymous HTTP requests to search endpoints that return responses matching known restricted content fingerprints
Monitor reindexing events and record the effective user identity used by the indexer for each run
Track modifications to #__finder_* tables and correlate with the access level of the referenced content items

How to Mitigate CVE-2026-64792

Immediate Actions Required

Apply the vendor patch referenced on the Regular Labs Security Resources page as soon as it is available for your deployment
Purge the existing Smart Search index to remove content that was rendered under the administrator identity
Reindex the site only after confirming the indexer executes rendering under a public guest context
Restrict access to the public search endpoint until the index has been rebuilt and validated

Patch Information

Consult the Regular Labs Security Resources advisory for the specific patched versions and update instructions. Apply the fix to all environments that run Smart Search indexing, including staging systems that may share index data with production.

Workarounds

Disable Smart Search indexing until the patch is applied and the index is rebuilt
Remove or unpublish plugins that inject administrator-only content into rendered output consumed by the indexer
Temporarily restrict the search component to authenticated users while remediation is in progress
Rotate any secrets or tokens that may have appeared in restricted content and been exposed through the index

bash

# Configuration example: purge and disable Smart Search index prior to patching
# 1. Disable the Smart Search component in the site administrator interface
# 2. Truncate finder tables (adjust prefix as needed)
mysql -u <db_user> -p <db_name> -e "\
  TRUNCATE TABLE \`#__finder_links\`; \
  TRUNCATE TABLE \`#__finder_links_terms\`; \
  TRUNCATE TABLE \`#__finder_terms\`;"
# 3. Re-enable Smart Search only after applying the vendor patch
# 4. Trigger a full reindex and verify no restricted items appear in results