What is GHSA-rgf5-hq4r-xjxf?

GHSA-rgf5-hq4r-xjxf is a security advisory published by GitHub Security Advisories with High severity. Joomla Extension - joomshaper.com - Broken Access Control (ACL Bypass) in ApiController Record...

Which CVE IDs does GHSA-rgf5-hq4r-xjxf cover?

GHSA-rgf5-hq4r-xjxf covers the following CVE IDs: CVE-2026-90904. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-rgf5-hq4r-xjxfHigh

Joomla Extension - joomshaper.com - Broken Access Control (ACL Bypass) in ApiController Record...

Vendor

GitHub Security Advisories

Published

September 23, 2026

Last Modified

September 23, 2026

🔗 CVE IDs covered (1)

CVE-2026-90904 →

📋 Description

Joomla Extension - joomshaper.com - Broken Access Control (ACL Bypass) in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0 - The allowEdit() method in ApiController.php hardcoded return true;, bypassing Joomla component-level and asset-level ACL permission checks. Any authenticated backend user could edit any EasyStore record, regardless of specific ACL permission grants. Resolved by replacing the hardcoded boolean with proper ACL authorization checks via AccessControl::create()->canEdit()`.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-90904
https://www.joomshaper.com/easystore
https://github.com/advisories/GHSA-rgf5-hq4r-xjxf