High severityNVD Advisory· Published Sep 23, 2026· Updated Sep 23, 2026
CVE-2026-90904
CVE-2026-90904
Description
Joomla Extension - joomshaper.com - Broken Access Control (ACL Bypass) in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0 - The allowEdit() method in ApiController.php hardcoded return true;, bypassing Joomla component-level and asset-level ACL permission checks. Any authenticated backend user could edit any EasyStore record, regardless of specific ACL permission grants. Resolved by replacing the hardcoded boolean with proper ACL authorization checks via AccessControl::create()->canEdit()`.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: 1.0.0-3.0.0
- Range: 1.0.0-3.0.0
Patches
Vulnerability mechanics
References
1News mentions
0No linked articles in our index yet.