The Cotton Cloud extension for Joomla, developed by tabaoca.org, suffers from an improper access control vulnerability (CWE-284) in versions 1.0.0 through 2.0.1. This vulnerability allows unauthenticated attackers to perform various file-related operations including reading, deleting, overwriting, and re-assigning permissions on any file managed by the extension. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low impact on confidentiality and integrity, with no impact on availability. No official remediation or patch information is currently available.

Unauthenticated attackers can manipulate files managed by the Cotton Cloud extension, potentially leading to unauthorized disclosure, modification, or deletion of files. This could compromise the integrity and confidentiality of data handled by the extension. However, the impact on availability is not indicated. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. Until a patch is available, consider restricting access to the extension or disabling it if feasible to reduce exposure.