CVE-2026-64796 describes multiple improper access control vulnerabilities (CWE-284) in the Sourcerer extension for Joomla by regularlabs.com. The Free version does not require both the article creator and last modifier to have Super User privileges before executing PHP code embedded in articles. The Pro version inconsistently enforces configured permissions for CSS, JavaScript, and PHP across tags, attributes, files, and article ownership. Furthermore, PHP include attributes can escape the designated include folder, and certain executable script and style variants can bypass detection mechanisms. These flaws allow unauthorized code injection and execution, leading to high impact on confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 score of 9.8, indicating critical severity. No official patch or remediation guidance is currently available, and no known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized code execution within Joomla articles, potentially allowing attackers to execute arbitrary PHP, CSS, or JavaScript code. This compromises the confidentiality, integrity, and availability of the affected Joomla site. The vulnerability affects both Free and Pro versions differently but results in elevated privileges and unauthorized actions. Given the critical CVSS score of 9.8, the impact is severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict article editing permissions to trusted Super Users only and avoid using the vulnerable versions of the Sourcerer extension. Monitor official regularlabs.com and Joomla advisories for updates and patches. Do not rely on partial permission enforcement as it is inconsistent in the affected versions.