CVE-2026-90905

Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0 - The endpoint administrator/index.php?option=com_easystore&task=appconfig.updateConfiguration updated core Joomla mail configuration (fromname, mailfrom) in configuration.php without verifying anti-CSRF tokens or checking for administrative permissions (canAdmin). A malicious site could silently modify the site's sender name and email address via forged requests from an admin's browser. Resolved by enforcing Session::checkToken('request') / Session::checkToken('post') and adding explicit administrative authorization verification via AccessControl::create()->canAdmin().

• CWE-284
• CWE-352

• https://www.joomshaper.com/easystore

Published

Sep 23, 2026

Last Modified

Sep 23, 2026

Status

Awaiting Analysis

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9090Casdoor versions 2.362.0 and earlier contain a vulnerability…9.1
• CVE-2026-90900Joomla Extension - joomshaper.com - Missing CSRF Token Verif…5.3
• CVE-2026-90901Joomla Extension - joomshaper.com - Authenticated, Privilege…8.6
• CVE-2026-90902Joomla Extension - joomshaper.com - Authenticated, Privilege…8.6
• CVE-2026-90903Joomla Extension - joomshaper.com - Missing CSRF Token Verif…7.2
• CVE-2026-90904Joomla Extension - joomshaper.com - Broken Access Control (A…8.6
• CVE-2026-9091Casdoor versions 2.362.0 and earlier contain a logic flaw in…5.3
• CVE-2026-90919LightLLM through 1.2.0 contains a remote code execution vuln…9.8
• CVE-2026-9092Casdoor versions 2.362.0 and earlier contain a vulnerability…9.1
• CVE-2026-90922The Paid Membership Subscriptions WordPress plugin before 3…5.3
• CVE-2026-90923The Autopay WordPress plugin before 5.0.1 does not enforce t…6.5
• CVE-2026-90927filebrowser through 2.63.23 fails to limit WebSocket message…6.5