CVE-2026-90904

Joomla Extension - joomshaper.com - Broken Access Control ACL Bypass in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0 - The allowEdit method in ApiController.php hardcoded return true;, bypassing Joomla component-level and asset-level ACL permission checks. Any authenticated...

CVE-2026-90904

The Easy Store extension (versions 1.0.0-3.0.0 ) by joomshaper.com contains a Broken Access Control vulnerability. The allowEdit() method in ApiController.php hardcodes a return true; statement, which bypasses Joomla's component-level and asset-level ACL permission checks . This allows any authen...

CVE-2026-90904: Improper Access Control

Joomla Extension - joomshaper.com - Broken Access Control ACL Bypass in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0 - The allowEdit method in ApiController.php hardcoded return true;, bypassing Joomla component-level and asset-level ACL permission checks. Any authenticated...