CVE-2026-90899
Awaiting Analysis Awaiting Analysis - Queue

Unauthenticated PII Exposure via IDOR in Easy Store Joomla Extension

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: Joomla! Project

Description
Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.0 - The checkout.searchGuestUser endpoint allowed querying guest checkout records solely by supplying an email address. The server returned complete shipping details (full name, phone number, street address, city, postal code, and country) directly from the #__easystore_guests table with no authentication, session validation, or ownership checks. An unauthenticated attacker could iterate through email lists to enumerate guest customers and harvest sensitive Personally Identifiable Information (PII). Resolved by removing the unauthenticated server-side guest lookup endpoint entirely and migrating autofill functionality to client-side localStorage protected by explicit user consent.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-24
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-90899
EUVD
EUVD-2026-85549

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
joomshaper easystore From 1.0.0 (inc) to 3.0.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in the Easy Store Joomla extension versions 1.0.0 to 3.0.0. It allows unauthenticated attackers to access Personally Identifiable Information (PII) by querying guest checkout records using only an email address. The server returned full shipping details including names, phone numbers, addresses, and more without any authentication or validation.

Detection Guidance

Check for unauthorized access to the checkout.searchGuestUser endpoint by monitoring server logs for repeated requests with varying email addresses. Look for GET/POST requests to /index.php?option=com_easystore&task=checkout.searchGuestUser without session tokens or authentication headers.

Impact Analysis

Unauthenticated attackers could enumerate guest customers by iterating through email lists and harvest sensitive PII such as full names, phone numbers, street addresses, cities, postal codes, and countries. This exposes customers to identity theft, fraud, or targeted phishing attacks.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access and exposure of personal data without consent. It may also breach HIPAA if healthcare-related customer data was exposed. Organizations using affected versions must report breaches and could face fines for non-compliance with data protection regulations.

Mitigation Strategies

Immediately disable or remove the EasyStore extension versions 1.0.0-3.0.0. Update to the latest patched version if available. Block external access to the checkout.searchGuestUser endpoint via firewall rules or server configuration. Review server logs for signs of exploitation and audit exposed PII.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90899. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart