CVE-2026-21626CWE-200

Extension - stackideas.com - Information disclosure in post custom fields in EasyDiscuss 1.0.0-5.0.15 for Joomla

Critical · published February 6, 2026

CVSS v4.0
9.2
EPSS
0%
Percentile
34.8
In the wild
Unconfirmed
What it is

Access control settings for forum post custom fields are not applied to the JSON output type, leading to an ACL violation vector an information disclosure

The record
Technical detail
CVSS v4.0
9.2 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
EPSS
0.00415 · 34.8th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-02-06T07:49Z
EPSS history
Timeline
  • 06 FEB 07:49Z
    Extension - stackideas.com - Information disclosure in post custom fields in EasyDiscuss 1.0.0-5.0.15 for Joomla
    cvelistv5