Easydiscuss
CVE-2026-21626
HIGH
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
Access control settings for forum post custom fields are not applied to the JSON output type, leading to an ACL violation vector an information disclosure
AnalysisAI
Easydiscuss fails to enforce access control restrictions on custom forum post fields when outputting data in JSON format, allowing unauthenticated remote attackers to retrieve sensitive information that should be restricted. This information disclosure vulnerability affects users whose forum configurations rely on field-level access controls. No patch is currently available for affected installations.
Technical ContextAI
Classified as CWE-200 (Information Exposure). Affects Easydiscuss. Access control settings for forum post custom fields are not applied to the JSON output type, leading to an ACL violation vector an information disclosure
RemediationAI
Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.
More in Easydiscuss
View allSQL injection vulnerability in StackIdeas EasyDiscuss v.5.0.5 and fixed in v.5.0.10 allows a remote attacker to obtain s
The StackIdeas EasyDiscuss (aka com_easydiscuss) extension before 4.0.21 for Joomla!. Rated medium severity (CVSS 5.4),
Arbitrary file upload in Joomla's Easy Discuss component allows authenticated attackers to bypass file validation by spo
Insufficient input validation in the Easy Discuss component for Joomla allows authenticated users to inject persistent c
Stored cross-site scripting in Joomla's Easy Discuss component allows authenticated users to inject malicious scripts in
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today