CVE-2026-21626 Extension - stackideas.com - Information disclosure in post custom fields in EasyDiscuss 1.0.0-5.0.15 for Joomla
Attackers can access restricted forum post custom fields via JSON output due to missing access control checks in the EasyDiscuss extension.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-21626?
CVE-2026-21626 is a critical vulnerability in Stackideas.com EasyDiscuss extension for Joomla, published on 6 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Access control settings for forum post custom fields are not applied to the JSON output type, leading to an ACL violation vector an information disclosure
Weakness: CWE-200
Which versions are affected by CVE-2026-21626?
It affects 1 product.
Products include Stackideas Easydiscuss.
How do I fix CVE-2026-21626?
No fix has been published for CVE-2026-21626 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-21626 being exploited?
There is no known exploitation of CVE-2026-21626 in the wild and no public exploit code.
Other vulnerabilities in Stackideas.com EasyDiscuss extension for Joomla
- CVE-2026-21623 Extension - stackideas.com - Persistent XSS in EasyDiscuss component 1.0.0-5.0.15 for Joomla
- CVE-2026-21624 Extension - stackideas.com - Persistent XSS in EasyDiscuss component 1.0.0-5.0.15 for Joomla
- CVE-2023-51810 SQL injection in n/a
- CVE-2018-5263 Cross-site scripting in n/a
- CVE-2026-21625 Extension - stackideas.com - Lack of mime type validation in EasyDiscuss component 1.0.0-5.0.15 for Joomla
Sources
Also known as GHSA-xfjv-gcf8-3jqc.