CVE-2026-63265 describes a CSRF vulnerability in the Advanced Module Manager extension for Joomla by regularlabs.com. The issue arises because privileged AJAX endpoints do not consistently enforce CSRF token validation aligned with component/item permissions and trusted server-generated form configurations. This inconsistency allows authenticated users with lower privileges or attackers leveraging CSRF attacks to invoke lookups or mutations outside their authorized scope. The vulnerability affects versions from 1.0.0 up to and including 11.0.1. No CVSS score or vendor remediation details are currently available.

Exploitation of this vulnerability could allow an attacker who is authenticated with lower privileges or a remote attacker via CSRF to perform unauthorized actions on privileged AJAX endpoints. This may lead to unauthorized data lookups or modifications beyond the attacker's intended permissions, potentially compromising the integrity of the Joomla site managed with this extension.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected AJAX endpoints, implementing additional CSRF protections at the application or web server level, or disabling the Advanced Module Manager extension if feasible.