CVE-2026-90905: Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0
Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0 - The endpoint administrator/index.php?option=comeasystore&task=appconfig.updateConfiguration updated core Joomla mail configuration (fromname, mailfrom) in configuration.php without verifying anti-CSRF tokens or checking for administrative permissions (canAdmin). A malicious site could silently modify the site's sender name and email address via forged requests from an admin's browser. Resolved by enforcing Session::checkToken('request') / Session::checkToken('post') and adding explicit administrative authorization verification via AccessControl::create()->canAdmin().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
For the Easy Store endpoint administrator/index.php?option=com_easystore&task=appconfig.updateConfiguration, enforce Session::checkToken('request') or Session::checkToken('post') and require explicit administrative authorization via AccessControl::create()->canAdmin() before updating fromname or mailfrom in configuration.php.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using Easy Store versions 1.0.0 through 3.0.0 are affected. Exploitation requires an administrator to visit a malicious site while authenticated to the Joomla administration interface.
What can an attacker change through the vulnerable endpoint?
The attacker can modify Joomla's core mail sender name and sender email address settings, specifically fromname and mailfrom, in configuration.php. The described impact is limited to these mail configuration values.
Does exploitation require administrative authorization or a valid CSRF token?
No. The vulnerable endpoint did not verify anti-CSRF tokens and did not check administrative permissions through canAdmin. A forged request sent through an authenticated administrator's browser could perform the update.
How can I determine whether my installation is affected?
Check whether Easy Store is installed and whether its version falls between 1.0.0 and 3.0.0. Review the Joomla mail sender name and email address settings for unexpected changes.