CVE-2026-64793 is an improper access control vulnerability (CWE-284) in the Articles Anywhere extension for Joomla by regularlabs.com. The vulnerability allows content authors to bypass access controls and publication restrictions by leveraging content tags that use ignore flags or property overrides. This can lead to unauthorized exposure of restricted or unpublished content to visitors without the required access privileges. The vulnerability is present in versions 1.0.0 through 18.0.2. The CVSS v3.1 base score is 9.1 (critical), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality and integrity impact. No patch or official remediation is currently available.

The vulnerability enables unauthorized users to view restricted or unpublished articles or modules by exploiting content tags that bypass access controls. This results in a high confidentiality impact as sensitive or restricted content can be exposed to unauthorized visitors. Integrity is also impacted since content publication status can be bypassed. Availability is not affected. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict content author permissions to trusted users only and monitor for suspicious content tag usage that could exploit this vulnerability.