CVE-2026-67284 describes an improper access control issue in the Cotton Cloud extension for Joomla by tabaoca.org. Versions from 1.0.0 up to and including 2.0.2 are affected. The flaw allows authenticated users with limited privileges to perform unauthorized file operations on files owned by other users, including reading, deleting, overwriting, and re-assigning permissions. This indicates a failure in enforcing proper access control checks within the extension's file management functionality. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Authenticated users with limited privileges can manipulate files owned by other users, potentially leading to unauthorized data disclosure, data loss, or privilege escalation within the Joomla environment. The impact is limited to users who have some level of authentication but can affect file integrity and confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Cotton Cloud extension to trusted users only and monitor for suspicious file operations. Avoid granting unnecessary file operation permissions to authenticated users.