CVE-2026-85188 Overview
CVE-2026-85188 is an authorization flaw in multiple Regular Labs extensions for Joomla. The Conditions editor accepts database table and column names from user requests without restricting them to tables tied to supported Regular Labs integrations. An authenticated attacker with elevated privileges can select arbitrary but valid database fields and disclose their contents through the default Condition Set name generation logic. The issue is classified as information disclosure [CWE-200] rather than SQL injection because identifiers are properly quoted.
Critical Impact
An authenticated attacker with high privileges can read sensitive data from unrelated database tables through the Conditions editor.
Affected Products
- Advanced Module Manager (Free, Pro) < 12.1.0
- Conditional Content (Free, Pro) < 8.0.0
- Content Templater (Pro) < 14.2.0
- ReReplacer (Pro) < 16.2.0
Discovery Timeline
- 2026-09-14 - CVE-2026-85188 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-85188
Vulnerability Analysis
The Conditions editor in the affected Regular Labs extensions generates a default Condition Set name derived from the item that the set is linked to. To build that name, the code queries the database using a table name and a label-column name supplied through the HTTP request. While the code quotes these values as SQL identifiers, it does not validate that the identifiers correspond to tables or columns registered with a supported Regular Labs integration.
An attacker who can access the Conditions editor can substitute any valid table and column name in the Joomla database. The resulting query executes and the returned value is surfaced back in the generated Condition Set name. This allows disclosure of arbitrary column values from arbitrary tables the database user can read.
Root Cause
The root cause is missing authorization on user-supplied database identifiers. The code trusts that requests originate from the intended editor flow and does not enforce an allowlist of Regular Labs integration tables and columns. Identifier quoting prevents SQL injection but does nothing to restrict which fields may be read.
Attack Vector
Exploitation requires authenticated access with high privileges to the Joomla backend, where the Conditions editor is reachable over the network. The attacker crafts a request that specifies a target table and label column, then reads the disclosed value from the response containing the generated Condition Set name. No user interaction is required. Refer to the Regular Labs Official Site for vendor advisories and update details.
Detection Methods for CVE-2026-85188
Indicators of Compromise
- Requests to the Conditions editor endpoints of affected Regular Labs extensions containing table or column parameters that reference core Joomla tables such as #__users or #__user_profiles.
- Backend administrative sessions that repeatedly invoke Condition Set creation with varying table and column identifiers.
- Unusual read patterns in database logs against tables that are not part of any Regular Labs integration.
Detection Strategies
- Inspect Joomla access logs for POST or GET requests to Regular Labs Conditions editor components that include table and column name parameters outside the expected integration set.
- Correlate administrator account activity with database query logs to identify identifier substitution attempts.
- Alert on repeated Condition Set creation events from a single administrator session within short time windows.
Monitoring Recommendations
- Enable database query logging for the Joomla database user and monitor selects against sensitive tables issued by web application processes.
- Track privileged Joomla account logins and flag sessions that access extension configuration areas from new IP addresses.
- Review web application firewall telemetry for parameter tampering targeting Regular Labs endpoints.
How to Mitigate CVE-2026-85188
Immediate Actions Required
- Upgrade Advanced Module Manager to 12.1.0 or later, Conditional Content to 8.0.0 or later, Content Templater to 14.2.0 or later, and ReReplacer to 16.2.0 or later.
- Audit Joomla administrator and manager accounts and remove access for users who do not require Regular Labs extension configuration.
- Rotate credentials or tokens that may have been exposed if any Joomla database columns storing secrets were readable by the affected user.
Patch Information
Regular Labs has published fixed releases for each affected extension. Administrators should apply the vendor updates listed above through the Joomla extensions manager or by downloading builds from the Regular Labs Official Site.
Workarounds
- Restrict access to the Joomla administrator backend to trusted IP ranges until patches are deployed.
- Temporarily disable the affected Regular Labs extensions on installations where an immediate upgrade is not possible.
- Reduce the privileges of the Joomla database user to the minimum tables required for site operation to limit the data reachable through this flaw.
# Configuration example: restrict administrator access at the web server
<Location "/administrator">
Require ip 10.0.0.0/8
</Location>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
