---
id: CVE-2026-90904
title: >-
  Joomla Extension - joomshaper.com - Broken Access Control (ACL Bypass) in
  ApiController Record Editing in Easy Store extension 1.0.0-3.0.0 - The
  allowEdit() method in ApiController.php hardcoded return true;, bypassing
  Joomla component-l…
summary: >-
  Joomla Extension - joomshaper.com - Broken Access Control (ACL Bypass) in
  ApiController Record Editing in Easy Store extension 1.0.0-3.0.0 - The
  allowEdit() method in ApiController.php hardcoded return true;, bypassing
  Joomla component-l…
severity: high
cvss: 8.6
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
cwe:
  - CWE-284
vendor: joomshaper.com
product: Easy Store extension for Joomla
affected:
  - easy_store_extension_for_joomla 1.0.0-3.0.0
published: '2026-09-23'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T20:17:21.633'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90904'
references:
  - url: 'https://www.joomshaper.com/easystore'
    label: security@joomla.org
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-23T19:32:53.703988Z'
cvssSource: cna
ingestedAt: '2026-09-23T19:31:04.472Z'
epss: 0.00313
epssPercentile: 0.21638
---

## Overview

Joomla Extension - joomshaper.com - Broken Access Control (ACL Bypass) in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0 - The allowEdit() method in ApiController.php hardcoded return true;, bypassing Joomla component-level and asset-level ACL permission checks. Any authenticated backend user could edit any EasyStore record, regardless of specific ACL permission grants. Resolved by replacing the hardcoded boolean with proper ACL authorization checks via AccessControl::create()->canEdit()`.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.