CVE-2026-21626 CRITICAL

CVE-2026-21626: Extension - stackideas.com - Information disclosure in post custom fields in EasyDiscuss 1.0.0-5.0.15 for Joomla

Vendor Stackideas.com
Product EasyDiscuss extension for Joomla
Weakness CWE-200 · Info exposure
Published February 6, 2026
Last update February 20, 2026
View on NVD All CVEs

CVSS base score

9.2/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

What the vulnerability does

01Description

Access control settings for forum post custom fields are not applied to the JSON output type, leading to an ACL violation vector an information disclosure

Explanation of Vulnerability in Simple Terms

02Summary

The EasyDiscuss extension for Joomla exposes sensitive information to unauthenticated attackers over the network. An attacker can retrieve confidential data without needing valid credentials or user interaction. This affects all versions from 1.0.0 through 5.0.15. Site administrators should update immediately to a patched version.

What an attacker can do

03Attacker Capabilities

Read sensitive information from the site without logging in.

Potential impact on your site

04Site Impact

Confidential data (user details, private discussions, or settings) may be publicly visible to anyone on the internet.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

February 6, 2026 CVE published
February 20, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2025-14507 EventPrime - Events Calendar, Bookings and Tickets <= 4.2.7.0 - Unauthenticated Sensitive Information Exposure via REST API CVE-2025-15508 Magic Import Document Extractor <= 1.0.6 - Unauthenticated Sensitive Information Exposure CVE-2026-3594 Riaxe Product Customizer <= 2.4 - Unauthenticated Sensitive Information Disclosure via '/orders' REST API Endpoint CVE-2026-1556 Information disclosure via file URI overwrite in File (Field) Paths CVE-2025-15527 WP Recipe Maker <= 10.2.2 - Insecure Direct Object Reference to Sensitive Information Exposure