https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 21:55:22 +0000 https://vulnerability.circl.lu/vuln/cve-2026-90905 <p><strong>Affected:</strong> joomshaper.com Easy Store extension for Joomla</p> <p>Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0 - The endpoint administrator/index.php?option=com_easystore&amp;task=appconfig.updateConfiguration updated core Joomla mail configuration (fromname, mailfrom) in configuration.php without verifying anti-CSRF tokens or checking for administrative permissions (canAdmin). A malicious site could silently modify the site&#39;s sender name and email address via forged requests from an admin&#39;s browser. Resolved by enforcing Session::checkToken(&#39;request&#39;) / Session::checkToken(&#39;post&#39;) and adding explicit administrative authorization verification via AccessControl::create()-&gt;canAdmin().</p> <p><strong>Affected:</strong> joomshaper.com Easy Store extension for Joomla</p> <p>Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0 - The endpoint administrator/index.php?option=com_easystore&amp;task=appconfig.updateConfiguration updated core Joomla mail configuration (fromname, mailfrom) in configuration.php without verifying anti-CSRF tokens or checking for administrative permissions (canAdmin). A malicious site could silently modify the site&#39;s sender name and email address via forged requests from an admin&#39;s browser. Resolved by enforcing Session::checkToken(&#39;request&#39;) / Session::checkToken(&#39;post&#39;) and adding explicit administrative authorization verification via AccessControl::create()-&gt;canAdmin().</p> https://vulnerability.circl.lu/vuln/cve-2026-90905