CVE-2026-90904: Joomla Easy Store ACL Bypass Vulnerability

CVE-2026-90904 Overview

CVE-2026-90904 is a broken access control vulnerability [CWE-284] in the JoomShaper EasyStore extension for Joomla, affecting versions 1.0.0 through 3.0.0. The allowEdit() method in ApiController.php returned a hardcoded true, bypassing Joomla's component-level and asset-level Access Control List (ACL) checks. Any authenticated backend user could edit arbitrary EasyStore records regardless of their assigned permissions. The issue was resolved by replacing the hardcoded boolean with a proper authorization check via AccessControl::create()->canEdit().

Critical Impact

Authenticated backend users can modify any EasyStore record, undermining role-based restrictions across the storefront.

Affected Products

• JoomShaper EasyStore extension for Joomla, version 1.0.0
• JoomShaper EasyStore extension for Joomla, versions 2.x
• JoomShaper EasyStore extension for Joomla, version 3.0.0

Discovery Timeline

• 2026-09-23 - CVE-2026-90904 published to the National Vulnerability Database (NVD)
• 2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-90904

Vulnerability Analysis

The flaw resides in the EasyStore ApiController class, which exposes record editing endpoints to authenticated backend users. The allowEdit() authorization method is invoked to determine whether a caller can modify a specific EasyStore record. In vulnerable releases, this method returned true unconditionally, short-circuiting Joomla's ACL enforcement.

As a result, permission grants defined at the Joomla component level and the asset level had no effect on edit operations exposed by the extension. Any user with backend access, including low-privilege staff accounts, could invoke edit actions on records belonging to other users, categories, or roles. The fix routes the decision through AccessControl::create()->canEdit(), which evaluates configured ACL rules before permitting the mutation.

Root Cause

The root cause is an insecure authorization stub. The developer replaced or scaffolded the ACL check with return true; and shipped that placeholder in production releases. This is a classic broken access control pattern [CWE-284] where the enforcement point exists but never denies a request.

Attack Vector

Exploitation requires authenticated access to the Joomla backend and network reachability to the EasyStore API endpoints. The attacker sends record edit requests through the exposed ApiController routes. Because allowEdit() always approves the operation, the request succeeds without triggering ACL denials, permitting tampering with product data, orders, or other EasyStore records.

No verified public exploit code is available. See the JoomShaper EasyStore Overview for product context.

Detection Methods for CVE-2026-90904

Indicators of Compromise

• Unexpected modifications to EasyStore records made by user accounts that lack explicit edit permissions in Joomla ACL configuration.
• Backend API requests to the EasyStore ApiController edit endpoints originating from low-privilege administrative accounts.
• Audit log entries showing record edits without corresponding permission grants for the acting user.

Detection Strategies

• Review Joomla action logs for edit events on EasyStore records and correlate the acting user against the ACL permission matrix.
• Inspect web server access logs for POST or PUT requests to EasyStore API routes from accounts that should not have edit rights.
• Compare current record ownership and category assignments against known-good backups to identify unauthorized changes.

Monitoring Recommendations

• Enable Joomla User Actions Logging for the EasyStore component and forward logs to a centralized SIEM for correlation.
• Monitor authentication events for the Joomla administrator interface and alert on activity from staff accounts outside normal working hours.
• Track version metadata of the EasyStore extension across managed Joomla sites to confirm patched builds are deployed.

How to Mitigate CVE-2026-90904

Immediate Actions Required

• Upgrade the JoomShaper EasyStore extension to a version above 3.0.0 that includes the AccessControl::create()->canEdit() authorization check.
• Audit all backend user accounts and revoke access for accounts that no longer require EasyStore administration privileges.
• Review EasyStore records for unauthorized modifications and restore from backup where tampering is confirmed.

Patch Information

JoomShaper resolved the flaw by removing the hardcoded return true; from allowEdit() in ApiController.php and delegating the decision to AccessControl::create()->canEdit(). Administrators should obtain the updated extension package from the vendor. Refer to the JoomShaper EasyStore Overview for download and release information.

Workarounds

• Restrict backend access to trusted administrators only by tightening Joomla User Group assignments until the patch is applied.
• Place the Joomla administrator interface behind an IP allowlist or VPN to reduce the pool of users who can reach the vulnerable endpoint.
• Temporarily disable the EasyStore component on production sites where an immediate upgrade is not feasible.

# Verify installed EasyStore version via Joomla CLI
php cli/joomla.php extension:list | grep -i easystore

# Restrict administrator interface access at the web server layer (nginx example)
location /administrator/ {
    allow 10.0.0.0/8;
    deny all;
}