High severity · published Sep 23, 2026
CVE-2026-90904
Joomla Extension - joomshaper.com - Broken Access Control (ACL Bypass) in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0
8.6
CVSS
0.4%
EPSS
No
On KEV
Description
Joomla Extension - joomshaper.com - Broken Access Control (ACL Bypass) in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0 - The allowEdit() method in ApiController.php hardcoded return true;, bypassing Joomla component-level and asset-level ACL permission checks. Any authenticated backend user could edit any EasyStore record, regardless of specific ACL permission grants. Resolved by replacing the hardcoded boolean with proper ACL authorization checks via AccessControl::create()->canEdit()`.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ES
Easy Store extension for Joomla · joomshaper.com
1.0.0-3.0.0 · source: vendor
Affected product
ES
Easy Store extension for Joomla
joomshaper.com
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-90904
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-90904
www.joomshaper.com
https://www.joomshaper.com/easystore
More from Easy Store extension for Joomla
9.3
CVE-2026-65761
Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1
9.2
CVE-2026-65760
Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1
8.7
CVE-2026-65759
Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1
8.6
CVE-2026-90901
Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0
8.6
CVE-2026-90902
Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in Easy Store extension 1.0.0-3.0.0