CVE-2026-90904CWE-284broken-access-control

CVE-2026-90904

published September 23, 2026

CVSS
8.6
EPSS
0%
Percentile
23.0
In the wild
Unconfirmed
What it is

Joomla Extension - joomshaper.com - Broken Access Control (ACL Bypass) in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0 - The allowEdit() method in ApiController.php hardcoded return true;, bypassing Joomla component-level and asset-level ACL permission checks. Any authenticated backend user could edit any EasyStore record, regardless of specific ACL permission grants. Resolved by replacing the hardcoded boolean with proper ACL authorization checks via AccessControl::create()->canEdit()`.

The record
Technical detail
CVSS
8.6 · NONE
CVSS v4.0
8.6 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00313 · 23.0th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-09-23T23:19Z
References (1)
https://www.joomshaper.com/easystore · [email protected]
EPSS history
Timeline
  • 25 SEP 03:28Z
    EPSS moved — → 0%
    epss
  • 23 SEP 18:37Z
    Joomla Extension - joomshaper.com - Broken Access Control (ACL Bypass) in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0
    cvelistv5