CVE-2026-90904

The Easy Store extension (versions 1.0.0-3.0.0 ) by joomshaper.com contains a Broken Access Control vulnerability. The allowEdit() method in ApiController.php hardcodes a return true; statement, which bypasses Joomla's component-level and asset-level ACL permission checks . This allows any authen...