CVE-2026-90899 is an unauthenticated Insecure Direct Object Reference (IDOR) vulnerability in the Easy Store extension for Joomla (versions 1.0.0 to 3.0.0). The vulnerable endpoint checkout.searchGuestUser allowed attackers to query guest checkout records by email address and receive complete shipping details from the #__easystore_guests database table without any authentication, session validation, or ownership checks. This allowed enumeration and harvesting of sensitive PII. The vendor mitigated the issue by removing the server-side guest lookup endpoint and implementing client-side autofill with user consent.

An unauthenticated attacker can enumerate guest checkout users by email and retrieve sensitive PII including full names, phone numbers, and full shipping addresses. This exposure risks privacy violations and potential targeted attacks against affected individuals. The vulnerability has a high severity CVSS score of 8.2, reflecting the ease of access and sensitivity of the data exposed. No known exploits in the wild have been reported.

The vulnerability has been resolved by the vendor through removal of the unauthenticated server-side guest lookup endpoint and migration of autofill functionality to client-side localStorage protected by explicit user consent. Users should upgrade to a fixed version beyond 3.0.0 once available or apply vendor-provided patches. Until then, disabling or restricting access to the vulnerable endpoint is recommended.