CVE-2026-64796: Authentication Bypass Vulnerability

CVE-2026-64796 Overview

CVE-2026-64796 identifies an improper access control weakness [CWE-284] in Regular Labs article extensions. The Free edition executes article PHP without confirming that both the article creator and the last modifier hold Super User privileges. The Pro edition does not consistently enforce configured CSS, JavaScript, and PHP permissions across tags, attributes, files, and both article owners. PHP include attributes can escape the configured include folder, and executable script or style variants can bypass content detection.

Critical Impact
A lower-privileged author or modifier can trigger execution of PHP embedded in articles, and attackers can bypass permission checks to load arbitrary scripts, styles, or included files outside the intended directory.

Affected Products

Regular Labs Free article extension (as described by the vendor advisory)
Regular Labs Pro article extension (as described by the vendor advisory)
Joomla sites integrating the affected Regular Labs components

Discovery Timeline

2026-07-22 - CVE-2026-64796 published to the National Vulnerability Database (NVD)
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-64796

Vulnerability Analysis

The flaw resides in how the Regular Labs article extensions decide whether embedded PHP, JavaScript, and CSS should execute. In the Free edition, the extension checks only one side of an article's ownership chain before running PHP. When an article is created by a Super User but later modified by a non-Super User, or the reverse, the code path still executes the embedded PHP. This breaks the intended dual-owner check.

The Pro edition adds configurable per-user permissions for CSS, JavaScript, and PHP content. Enforcement is inconsistent across the surfaces where such content can appear. Tag-based content, HTML attribute content, and file-based content follow different code paths. Not all paths honor the configured permissions for both the creator and the last modifier.

A second weakness affects PHP include handling. Attribute values passed to include directives can traverse outside the configured include folder. Executable script and style variants can also evade the detection routine used to gate execution.

Root Cause

The root cause is incomplete authorization logic. The extension evaluates privilege state on only one owner, and the checks are not applied uniformly across every location where dynamic content can be embedded. The include-path validator does not canonicalize input before comparing it to the allowed folder.

Attack Vector

An authenticated user with permission to create or edit articles can embed PHP, JavaScript, or CSS payloads. If either the creator or the last modifier is a Super User while the other is not, the Free extension still executes the PHP. In the Pro edition, an attacker chooses a tag, attribute, or file variant whose enforcement path skips the permission check. Crafted include attribute values traverse the filesystem outside the allowed folder, loading attacker-selected PHP files.

No verified proof-of-concept code has been published. See the Regular Labs Security Information advisory for technical details.

Detection Methods for CVE-2026-64796

Indicators of Compromise

Article records where the creator and last modifier have differing Super User status and contain {php}, {source}, or similar Regular Labs tags
Web server access to article rendering endpoints followed by unexpected PHP process spawning
Filesystem reads from paths outside the configured Regular Labs include folder, especially those containing ../ sequences
New or modified .php, .js, or .css files in content directories that were not deployed by administrators

Detection Strategies

Audit Joomla article revisions for embedded PHP, JavaScript, or CSS tags introduced by non-Super User accounts
Correlate web request logs with PHP interpreter process telemetry to flag article renders that trigger include operations
Inspect Regular Labs configuration to identify tags and attributes whose permissions differ from the intended policy

Monitoring Recommendations

Enable file integrity monitoring on the Joomla web root and any configured Regular Labs include folders
Log and alert on Joomla administrator role changes and article edits performed by non-Super User accounts
Forward web server, PHP-FPM, and Joomla audit logs to a centralized analytics platform for correlation

How to Mitigate CVE-2026-64796

Immediate Actions Required

Update the Regular Labs Free and Pro article extensions to the fixed versions listed in the vendor advisory
Review all articles containing embedded PHP, CSS, or JavaScript and remove content added by non-Super Users
Restrict article creation and edit permissions to trusted Super User accounts until the patch is applied
Verify that the configured include folder contains only files that administrators intend to be executable

Patch Information

Regular Labs has published fixed builds addressing both the dual-owner permission check in the Free edition and the inconsistent enforcement plus include-folder escape in the Pro edition. Refer to the Regular Labs Security Information page for the specific fixed release numbers and upgrade steps.

Workarounds

Disable the Regular Labs article extension until the update can be installed
Remove PHP, JavaScript, and CSS execution privileges from all non-Super User groups within the extension configuration
Set the configured include folder to a location containing only administrator-controlled files and enforce filesystem permissions that block writes by the web user

bash

# Configuration example: restrict include folder to read-only files owned by root
chown -R root:www-data /var/www/joomla/regularlabs-includes
find /var/www/joomla/regularlabs-includes -type d -exec chmod 750 {} \;
find /var/www/joomla/regularlabs-includes -type f -exec chmod 640 {} \;