A high-severity broken access control vulnerability in the JoomShaper Easy Store extension for Joomla allows authenticated backend users to bypass permission checks and modify sensitive records.

The vulnerability stems from a hardcoded return value in the allowEdit method within ApiController.php, which fails to enforce Joomla component or asset level access control lists for any authenticated backend user.

Successful exploitation of this flaw allows any authenticated backend user to perform unauthorized modifications to store records, potentially leading to data integrity issues or the manipulation of business-critical information. Given the CVSS score of 8.6, this vulnerability poses a significant risk to the security of the Joomla environment by circumventing established administrative access policies.

Immediate Action: Review the official JoomShaper advisory for the release of a security patch and update the Easy Store extension to the most recent version available.

Proactive Monitoring: Monitor backend access logs for unusual activity or unauthorized edits to store records performed by accounts with lower-level privileges.

Compensating Controls: If a patch is not yet available, restrict access to the Joomla backend to only essential administrative personnel and consider disabling the Easy Store extension until a secure version is deployed.

Public Exploit Available: Unknown

This vulnerability represents a critical failure in the authorization logic of the Easy Store extension, undermining the principle of least privilege within the Joomla environment. Administrators are urged to prioritize this update immediately upon vendor release to ensure that internal access controls remain effective and to prevent unauthorized record manipulation.