CVE-2026-64791

Name of the Vulnerable Software and Affected Versions Regular Labs Extension Manager (affected versions not specified)

Description Administrator routes and the processing of installation, updates, and uninstallation did not consistently enforce installation and component-management permissions. This flaw allows an unauthorized backend user or a Cross-Site Request Forgery (CSRF) attack—a technique where a malicious site tricks a user's browser into performing an unwanted action on a different site—to install, update, or remove extensions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.