CVE-2026-64791 describes a vulnerability in the Regular Labs Extension Manager extension for Joomla where CSRF token checks and privilege validations are inconsistently applied in administrator routes handling extension management tasks. This inconsistency allows unauthorized backend users or attackers leveraging CSRF to install, update, or remove Joomla extensions without appropriate authorization. The vulnerability affects versions 1.0.0 through 9.2.5 of the extension. The CVSS 3.1 base score is 8.8, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to perform unauthorized installation, update, or removal of Joomla extensions via the backend, potentially leading to full compromise of the Joomla environment, data loss, or service disruption. The vulnerability affects confidentiality, integrity, and availability of the affected system components.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should restrict backend access to trusted users only and consider implementing additional CSRF protections or monitoring for suspicious extension management activity. Avoid clicking on untrusted links while authenticated to the Joomla backend.