CVE-2026-63280 is a Cross-Site Request Forgery (CSRF) vulnerability in the Advanced Module Manager extension for Joomla developed by regularlabs.com. The issue stems from inconsistent CSRF token validation and privilege enforcement in the conditions administration functionality, which could allow an attacker to perform unauthorized actions by exploiting missing or improperly checked tokens and permissions. The vulnerability affects versions 1.0.0 through 11.0.1. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability could allow an attacker to perform unauthorized administrative actions within the Advanced Module Manager extension, potentially leading to full compromise of the affected Joomla component. The CVSS score of 8.8 reflects high impact on confidentiality, integrity, and availability, meaning sensitive data could be exposed or modified and system availability could be disrupted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected component and applying compensating controls to limit exposure. Monitor for updates from regularlabs.com regarding patches or official mitigations.