CVE-2026-90905 in Easy Store Extension
Summary
by MITRE • 09/23/2026
Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0 - The endpoint administrator/index.php?option=com_easystore&task=appconfig.updateConfiguration updated core Joomla mail configuration (fromname, mailfrom) in configuration.php without verifying anti-CSRF tokens or checking for administrative permissions (canAdmin). A malicious site could silently modify the site's sender name and email address via forged requests from an admin's browser. Resolved by enforcing Session::checkToken('request') / Session::checkToken('post') and adding explicit administrative authorization verification via AccessControl::create()->canAdmin().
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified in the Easy Store extension for Joomla, specifically affecting versions 1.0.0 through 3.0.0, represents a critical failure in both authentication and request validation mechanisms within the application's configuration management module. The core issue resides in the endpoint administrator/index.php?option=com_easystore&task=appconfig.updateConfiguration, which is responsible for updating fundamental Joomla mail settings such as fromname and mailfrom directly within the global configuration file. This operation allows an attacker to alter how outgoing emails are identified by recipients, potentially facilitating phishing campaigns or damaging organizational reputation if the sender identity is spoofed without detection. The severity of this flaw is compounded by the fact that it affects core system behavior rather than just extension-specific data, thereby impacting the integrity and trustworthiness of the entire Joomla installation.
From a technical perspective, the vulnerability stems from two distinct but related security oversights: the absence of Cross-Site Request Forgery protections and the lack of proper access control verification. When an administrator interacts with the backend interface to update configuration settings, standard web application security practices dictate that every state-changing request must be validated against a unique session token to ensure it originated from a legitimate user interaction within the current session. In this case, the appconfig.updateConfiguration task does not invoke Session::checkToken('request') or Session::checkToken('post'), leaving the endpoint vulnerable to CSRF attacks. An attacker can craft a malicious webpage containing an automated form submission that targets this specific URL with modified parameters for fromname and mailfrom. When an authenticated administrator visits this malicious page, their browser will automatically include valid session cookies, causing Joomla to process the forged request as if it were initiated by the admin themselves.
Furthermore, even if CSRF protections were in place, the endpoint fails to verify that the user executing the action possesses the necessary administrative privileges. The code does not call AccessControl::create()->canAdmin() or equivalent checks before allowing modifications to global configuration files. This means that any authenticated user with access to the Joomla backend, regardless of their specific role level, could potentially exploit this logic if combined with other privilege escalation flaws, although in a standard setup only super users typically have write access to configuration.php. The combination of missing CSRF tokens and insufficient authorization checks creates an attack vector where remote attackers can silently reconfigure email sending parameters without the administrator's knowledge or consent.
The operational impact of this vulnerability is significant for organizations relying on Joomla for communication. By altering the fromname and mailfrom fields, an attacker can make legitimate system emails appear to originate from a different domain or entity. This capability is frequently leveraged in social engineering attacks where recipients are tricked into believing they are receiving communications from a trusted source. Additionally, if the modified email address points to a malicious server controlled by the attacker, it could lead to further compromise through phishing links embedded in automated system notifications such as password resets or order confirmations sent via Easy Store e-commerce functionality. This undermines the integrity of transactional emails and can result in financial loss and reputational damage for businesses using the platform.
To mitigate this vulnerability, developers must implement robust session validation by integrating Session::checkToken('request') at the beginning of the updateConfiguration task to ensure that all POST requests are authenticated against a valid CSRF token generated during page load. Simultaneously, explicit authorization checks must be enforced using AccessControl::create()->canAdmin() or similar Joomla access control methods to verify that the current user has super administrator privileges before allowing any changes to global configuration files. These measures align with industry standards such as CWE-352 for Cross-Site Request Forgery and CWE-862 for Missing Authorization, ensuring that both identity verification and permission validation are strictly enforced. Organizations running affected versions of Easy Store should immediately update to a patched version or apply manual code patches to restore these critical security controls and prevent unauthorized modification of system configuration settings.