CVE-2026-63685 is an improper access control vulnerability (CWE-284) in the DB Replacer extension for Joomla by regularlabs.com. The vulnerability arises because administrator routes and replacement requests do not consistently require Super User permissions or a valid security token. This allows unauthorized backend users or attackers exploiting Cross-Site Request Forgery (CSRF) to perform database replacements. Such unauthorized actions could lead to major data corruption or compromise of the Joomla site. The affected versions include all releases from 1.0.0 up to and including 8.2.7. There is no vendor advisory or patch currently available, and no known exploits in the wild have been reported.

An attacker without proper authorization or a valid token can bypass access controls to perform database replacements via the Joomla backend. This can result in severe consequences including major data corruption and potential full site compromise. The vulnerability impacts confidentiality, integrity, and availability of the affected Joomla sites.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict backend access to trusted users only and consider disabling the DB Replacer extension if not essential. Monitor for updates from regularlabs.com regarding patches or official mitigations.