Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-90904

Easy Store extension for Joomla · Vulnerability

CVSS 4.0 8.6 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-90904

Published

Joomla Extension - joomshaper.com - Broken Access Control (ACL Bypass) in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0 - The allowEdit() method in ApiController.php hardcoded return true;, bypassing Joomla component-level and asset-level ACL permission checks. Any authenticated backend user could edit any EasyStore record, regardless of specific ACL permission grants. Resolved by replacing the hardcoded boolean with proper ACL authorization checks via AccessControl::create()->canEdit()`.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-90904

Published

Easy Store extension for Joomla

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "product": "Easy Store extension for Joomla",
                    "vendor": "joomshaper.com",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "1.0.0-3.0.0"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON