CVE-2026-90904

Joomla Extension - joomshaper.com - Broken Access Control (ACL Bypass) in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0

State: Published
Severity: 8.6 High
Published: Sep 23, 2026
Updated: Sep 23, 2026
Reserved: Sep 14, 2026

Read the record on cve.org

Description

Joomla Extension - joomshaper.com - Broken Access Control (ACL Bypass) in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0 - The allowEdit() method in ApiController.php hardcoded return true;, bypassing Joomla component-level and asset-level ACL permission checks. Any authenticated backend user could edit any EasyStore record, regardless of specific ACL permission grants. Resolved by replacing the hardcoded boolean with proper ACL authorization checks via AccessControl::create()->canEdit()`.

Scores

CVSS	Score	Vector	Source
4.0	8.6 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	Joomla

Weaknesses

CWE-284 Improper Access Control

Affected Products

Product	Versions
Easy Store extension for Joomlajoomshaper.com	1.0.0-3.0.0Affected

References

https://www.joomshaper.com/easystoreproduct

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.