CVE-2026-90904
Awaiting Analysis Awaiting Analysis - Queue

Broken Access Control in Easy Store Joomla Extension

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: Joomla! Project

Description
Joomla Extension - joomshaper.com - Broken Access Control (ACL Bypass) in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0 - The allowEdit() method in ApiController.php hardcoded return true;, bypassing Joomla component-level and asset-level ACL permission checks. Any authenticated backend user could edit any EasyStore record, regardless of specific ACL permission grants. Resolved by replacing the hardcoded boolean with proper ACL authorization checks via AccessControl::create()->canEdit()`.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-24
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-90904
EUVD
EUVD-2026-85550

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
joomshaper easy_store From 1.0.0 (inc) to 3.0.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Broken Access Control vulnerability in the Easy Store Joomla extension versions 1.0.0 to 3.0.0. The issue is in the ApiController.php file where the allowEdit() method always returns true, bypassing Joomla's access control lists (ACL). This allows any authenticated backend user to edit any record in the Easy Store component, regardless of their assigned permissions.

Impact Analysis

If you use the affected Easy Store extension, an attacker with basic backend access could modify or delete records without proper authorization. This could lead to unauthorized changes in product listings, pricing, or other critical data, potentially disrupting your Joomla site's functionality or integrity.

Mitigation Strategies

Update the Easy Store extension to a version that replaces the hardcoded true in ApiController.php with proper ACL checks using AccessControl::create()->canEdit(). Remove or disable the vulnerable extension if no update is available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90904. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart