Vulnerability Description
Joomla Extension - joomshaper.com - Missing CSRF Token Verification across Administrator AJAX API Endpoints in Easy Store extension 1.0.0-3.0.0 - The administrator ApiController only validated CSRF tokens inside the products() action. All other administrative AJAX endpoints (orders, coupons, media, customers, settings, tags, categories, reviews, and collections) accepted state-changing requests without checking anti-CSRF tokens. An attacker could trick a logged-in administrator into triggering unauthorized state modifications across the store backend. Resolved by implementing global CSRF verification in ApiController::execute() for all state-changing HTTP methods (POST, PUT, PATCH, DELETE) via Session::checkToken().
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-90903?
CVE-2026-90903 is a documented vulnerability. Joomla Extension - joomshaper.com - Missing CSRF Token Verification across Administrator AJAX API Endpoints in Easy Store extension 1.0.0-3.0.0 - The administrator ApiController only validated CSRF to...
How severe is CVE-2026-90903?
CVSS scoring is not yet available for CVE-2026-90903. Check NVD for updates.
Is there a patch for CVE-2026-90903?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.