The Advanced Module Manager extension for Joomla improperly trusts spoofable forwarded headers when evaluating IP and GeoIP conditions. This flaw allows remote clients to spoof these headers, bypassing location-based rules intended to restrict access. The vulnerability is classified as CWE-290 (Authentication Bypass by Spoofing). It affects versions =1.0.0-11.0.1 of the extension. There is no CVSS score or vendor advisory indicating a patch or mitigation at this time.

Attackers can bypass location-based access controls by spoofing forwarded headers, potentially gaining unauthorized access to functionality or content restricted by geographic or IP-based rules. This undermines the intended security controls relying on IP or GeoIP verification within the affected extension.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling location-based rules relying on forwarded headers or implement additional validation to prevent header spoofing.