The Easy Store extension for Joomla versions 1.0.0 to 3.0.0 contains a broken access control vulnerability (CWE-284) in the ApiController's allowEdit() method. This method was hardcoded to always return true, effectively bypassing Joomla's ACL permission checks at both component and asset levels. Consequently, any authenticated backend user could edit any record in Easy Store without having the appropriate permissions. The vulnerability was fixed by implementing proper ACL checks via AccessControl::create()->canEdit().

An attacker with authenticated backend access can exploit this vulnerability to edit any Easy Store record regardless of their assigned permissions. This could lead to unauthorized data modification within the Easy Store component, potentially impacting data integrity and business operations relying on this extension.

A fix is available that replaces the hardcoded true return in allowEdit() with proper ACL authorization checks using AccessControl::create()->canEdit(). Users should update the Easy Store extension to a version that includes this fix. Since no patch links are provided, check the vendor's official site or Joomla extension repository for the updated version. Until patched, restrict backend user access to trusted administrators only.