CVE-2026-90905: Joomla Easy Store CSRF Vulnerability

CVE-2026-90905 Overview

CVE-2026-90905 affects the JoomShaper Easy Store extension for Joomla, versions 1.0.0 through 3.0.0. The extension exposes an administrative endpoint that updates core Joomla mail configuration without verifying anti-CSRF tokens or checking administrator permissions. An attacker can craft a malicious page that, when visited by an authenticated administrator, silently modifies the site's sender name and email address in configuration.php. The flaw is tracked as an improper access control weakness [CWE-284].

Critical Impact
Any site visited by a logged-in Joomla administrator can silently rewrite the mail sender identity, enabling phishing, brand impersonation, and password-reset interception.

Affected Products

JoomShaper Easy Store extension for Joomla, versions 1.0.0 through 3.0.0
Joomla sites using the vulnerable com_easystore component
Deployments exposing administrator/index.php?option=com_easystore&task=appconfig.updateConfiguration

Discovery Timeline

2026-09-23 - CVE-2026-90905 published to the National Vulnerability Database
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-90905

Vulnerability Analysis

The vulnerability resides in the appconfig.updateConfiguration task of the com_easystore administrator component. The handler writes attacker-controlled fromname and mailfrom values into Joomla's core configuration.php. Neither an anti-CSRF token nor an administrator authorization check gates the write operation. As a result, request forgery against an authenticated administrator succeeds without user interaction beyond visiting a hostile page.

Because the endpoint modifies core Joomla mail settings rather than extension-scoped data, downstream impact reaches every email the site sends. Modified sender identity supports phishing that appears to originate from the legitimate domain. Attackers can also redirect password-reset context or spoof transactional messages sent to customers.

Root Cause

The root cause is dual: missing request-integrity validation and missing authorization enforcement. The controller did not invoke Session::checkToken('request') or Session::checkToken('post') before processing the update. It also did not call AccessControl::create()->canAdmin() to confirm the caller held administrator rights. Any authenticated session with an active cookie was treated as sufficient to persist configuration changes.

Attack Vector

Exploitation requires a Joomla administrator to visit an attacker-controlled page while authenticated to the target site. The malicious page issues a cross-origin request to administrator/index.php?option=com_easystore&task=appconfig.updateConfiguration with crafted fromname and mailfrom parameters. The browser attaches the admin session cookie, and the vulnerable handler commits the values to configuration.php. No credentials, tokens, or additional prompts are required from the victim beyond loading the page.

See the JoomShaper EasyStore Overview for product context. No public proof-of-concept exploit code has been referenced in the CVE record.

Detection Methods for CVE-2026-90905

Indicators of Compromise

Unexpected changes to the fromname or mailfrom values in configuration.php outside of documented administrative activity.
Web server access log entries for administrator/index.php?option=com_easystore&task=appconfig.updateConfiguration with a Referer header pointing to an external domain.
Outbound mail from the Joomla site displaying a sender name or address that does not match the organization's brand standards.

Detection Strategies

Alert on POST or GET requests to the appconfig.updateConfiguration task that lack a same-origin Referer or a valid Joomla form token parameter.
Monitor file integrity for configuration.php and trigger on writes not correlated with an administrator's console session.
Correlate administrator authentication events with subsequent configuration updates to identify writes that occur without an active admin UI workflow.

Monitoring Recommendations

Enable Joomla action logs for the Easy Store component and forward them to a central log platform for retention and search.
Track bounce reports and DMARC failure reports for anomalies suggesting altered sender identity.
Baseline expected administrator source IP ranges and alert on com_easystore administrative requests originating from unusual networks.

How to Mitigate CVE-2026-90905

Immediate Actions Required

Upgrade the Easy Store extension to a release later than 3.0.0 that enforces Session::checkToken() and AccessControl::create()->canAdmin() on the configuration endpoint.
Audit configuration.php for unauthorized changes to fromname and mailfrom and restore known-good values.
Force administrator session invalidation and require re-authentication after patching.

Patch Information

JoomShaper resolved the issue by enforcing Session::checkToken('request') and Session::checkToken('post') on the appconfig.updateConfiguration handler and adding explicit administrator authorization via AccessControl::create()->canAdmin(). Administrators should install the fixed release published by the vendor. Refer to the JoomShaper EasyStore product page for release information.

Workarounds

Restrict access to /administrator/ by IP allowlist at the web server or WAF layer until the extension is updated.
Deploy a WAF rule that blocks requests to option=com_easystore&task=appconfig.updateConfiguration when the Referer header is missing or off-origin.
Instruct administrators to use a dedicated browser profile for Joomla administration and to log out immediately after use.

bash

# Example nginx rule to block cross-origin writes to the vulnerable task
location ~ ^/administrator/index\.php$ {
    if ($arg_option = "com_easystore") {
        if ($arg_task = "appconfig.updateConfiguration") {
            if ($http_referer !~* "^https?://your-joomla-site\.example/") {
                return 403;
            }
        }
    }
}