Broken Access Control in Easy Store Extension by JoomShaper
CVE-2026-90904

8.6HIGH

Key Information:

Vendor

Joomshaper.com

Status
Easy Store Extension For Joomla
Vendor
CVE Published:
23 September 2026

What is CVE-2026-90904?

The Easy Store extension by JoomShaper contains a vulnerability that allows authenticated backend users to bypass access control checks when editing records. This is due to the allowEdit() method in ApiController.php being hardcoded to return true, exposing sensitive functionalities to users without appropriate permissions. The issue can be mitigated by replacing the hardcoded return value with proper authorization checks to ensure compliance with Joomla's ACL.

Affected Version(s)

Easy Store extension for Joomla 1.0.0-3.0.0

References

https://www.joomshaper.com/easystore
product

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Phil Taylor, mysites.guru
.