CVE-2026-90904 in Easy Store Extension
Summary
by MITRE • 09/23/2026
Joomla Extension - joomshaper.com - Broken Access Control (ACL Bypass) in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0 - The allowEdit() method in ApiController.php hardcoded return true;, bypassing Joomla component-level and asset-level ACL permission checks. Any authenticated backend user could edit any EasyStore record, regardless of specific ACL permission grants. Resolved by replacing the hardcoded boolean with proper ACL authorization checks via AccessControl::create()->canEdit()`.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified in the Easy Store extension for Joomla versions 1.0.0 through 3.0.0 represents a critical failure in access control mechanisms, specifically classified under CWE-284 Improper Access Control. The core technical flaw resides within the ApiController.php file, where the allowEdit() method contains a hardcoded return true statement. This implementation error effectively neutralizes any security logic that should be executed to verify user permissions before allowing modifications to data records. By unconditionally returning true, the application fails to evaluate whether the currently authenticated backend user possesses the necessary privileges defined by Joomla's component-level and asset-level Access Control Lists. Consequently, this bypass allows any user with a valid administrative or backend account to modify, update, or potentially delete Easy Store records without restriction, regardless of their assigned role or specific permission grants within the Joomla ecosystem.
From an operational perspective, this vulnerability exposes sensitive business data stored within the Easy Store extension to unauthorized modification by any authenticated backend user. In many Joomla deployments, multiple users may have access to the administrative panel for various purposes such as content management, system configuration, or customer support. The lack of granular permission checks means that a user with limited privileges could inadvertently or maliciously alter product information, pricing details, inventory levels, or customer data associated with e-commerce operations. This integrity violation can lead to significant financial loss, reputational damage, and operational disruption for the website owner. Furthermore, because the vulnerability affects the API controller layer, it may also impact integrations that rely on these endpoints, potentially allowing attackers who have compromised a low-privilege account to escalate their influence within the application environment by altering critical data structures or configurations managed through Easy Store.
The resolution of this issue involves replacing the hardcoded boolean return value with proper authorization logic using Joomla's native AccessControl framework. Specifically, developers implemented checks via AccessControl::create()->canEdit() to ensure that every edit request is validated against the user's actual permissions before proceeding. This aligns with security best practices for role-based access control and ensures that only users explicitly granted the right to modify records can do so. In terms of threat modeling, this vulnerability maps to MITRE ATT&CK technique T1078 Valid Accounts, as it allows authenticated attackers to leverage their existing credentials to perform actions outside their intended scope. It also relates to CWE-269 Improper Privilege Management due to the failure to enforce least privilege principles within the application's internal logic.
To mitigate this risk and prevent similar issues in future development, organizations should ensure that all API endpoints undergo rigorous security testing focused on access control verification. Developers must avoid hardcoding permission checks and instead rely on established framework libraries for authorization decisions. Regular code audits are essential to identify such logical flaws before deployment. Additionally, implementing comprehensive logging of access attempts can aid in detecting potential exploitation activities post-deployment. Administrators should also enforce the principle of least privilege by carefully configuring Joomla's ACL settings, ensuring that backend users have only the minimum permissions necessary for their roles. Keeping all extensions updated to versions where this vulnerability is patched is critical for maintaining the integrity and security of the web application infrastructure.