CVE-2026-64797

{"id": "CVE-2026-64797", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-64797", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-28T14:07:57.833780Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@joomla.org", "affectedData": [{"vendor": "regularlabs.com", "product": "IP Login extension for Joomla", "versions": [{"status": "affected", "version": "1.0.0-6.2.5"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-22T21:18:10.870", "references": [{"url": "https://regularlabs.com/", "source": "security@joomla.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@joomla.org", "description": [{"lang": "en", "value": "CWE-290"}]}], "descriptions": [{"lang": "en", "value": "Joomla Extension - regularlabs.com - IP spoofing vulnerability in IP login extension - IP Login trusted forwarded client-IP headers without requiring a configured trusted proxy. Attackers could spoof the IP used for automatic login and potentially impersonate mapped accounts."}, {"lang": "es", "value": "Joomla Extensi\u00f3n - regularlabs.com - vulnerabilidad de suplantaci\u00f3n de IP en la extensi\u00f3n de inicio de sesi\u00f3n por IP - El inicio de sesi\u00f3n por IP confiaba en los encabezados de IP de cliente reenviados sin requerir un proxy de confianza configurado. Los atacantes podr\u00edan suplantar la IP utilizada para el inicio de sesi\u00f3n autom\u00e1tico y potencialmente suplantar la identidad de cuentas mapeadas."}], "lastModified": "2026-10-24T13:10:00.147", "sourceIdentifier": "security@joomla.org"}