CVE-2026-90904: Joomla Extension - joomshaper.com - Broken Access Control (ACL Bypass) in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0
Joomla Extension - joomshaper.com - Broken Access Control (ACL Bypass) in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0 - The allowEdit() method in ApiController.php hardcoded return true;, bypassing Joomla component-level and asset-level ACL permission checks. Any authenticated backend user could edit any EasyStore record, regardless of specific ACL permission grants. Resolved by replacing the hardcoded boolean with proper ACL authorization checks via AccessControl::create()->canEdit().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the Easy Store extension's ApiController.php, replace the hardcoded true return in allowEdit() with proper ACL authorization checks using AccessControl::create()->canEdit().
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Joomla backend user can exploit it. The affected method allows them to edit EasyStore records even when they lack the component-level or asset-level ACL permissions normally required.
Which EasyStore versions are affected?
Easy Store versions 1.0.0 through 3.0.0 are identified as affected.
How can I determine whether an installation is vulnerable?
Check the installed Easy Store version and inspect ApiController.php. A vulnerable implementation has allowEdit() hardcoded to return true; rather than performing authorization through AccessControl::create()->canEdit().
What should be done if an update cannot be applied immediately?
Restrict backend access to trusted users, since exploitation requires an authenticated backend account. Review backend users with access to EasyStore and limit or remove accounts that do not need administrative access.