CVE-2026-90903: Joomla Extension - joomshaper.com - Missing CSRF Token Verification across Administrator AJAX API Endpoints in Easy Store extension 1.0.0-3.0.0
Joomla Extension - joomshaper.com - Missing CSRF Token Verification across Administrator AJAX API Endpoints in Easy Store extension 1.0.0-3.0.0 - The administrator ApiController only validated CSRF tokens inside the products() action. All other administrative AJAX endpoints (orders, coupons, media, customers, settings, tags, categories, reviews, and collections) accepted state-changing requests without checking anti-CSRF tokens. An attacker could trick a logged-in administrator into triggering unauthorized state modifications across the store backend. Resolved by implementing global CSRF verification in ApiController::execute() for all state-changing HTTP methods (POST, PUT, PATCH, DELETE) via Session::checkToken().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Implement global CSRF verification in Easy Store's ApiController::execute() for all state-changing HTTP methods (POST, PUT, PATCH, and DELETE) using Session::checkToken().
Event History
Frequently Asked Questions
Which administrative functions were exposed to cross-site request forgery?
The affected AJAX endpoints included orders, coupons, media, customers, settings, tags, categories, reviews, and collections. The products action already performed CSRF token validation.
What does an attacker need to exploit this issue?
An attacker would need to induce a logged-in Easy Store administrator to send a crafted request to an affected administrative AJAX endpoint. The issue enables unauthorized state-changing actions in the store backend under that administrator's session.
Are read-only requests affected?
The remediation applies CSRF validation to state-changing POST, PUT, PATCH, and DELETE requests. The provided information does not identify GET or other read-only requests as affected.
How was the issue addressed?
CSRF verification was moved into ApiController::execute() so that all state-changing HTTP methods are checked with Session::checkToken(), rather than validating tokens only in the products action.